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Planning and Response to an Active Shooter 


Message from the Interagency Security 
Committee Chair 


One of the Department of Homeland Security’s (DHS) national priorities is the 
protection of Federal employees and private citizens who work within and visit 
U.S. government-owned or leased facilities. The Interagency Security 
Committee (ISC), chaired by DHS and consisting of 54 Federal departments 
and agencies, has as its mission the development of security standards and best practices for 
nonmilitary Federal facilities in the United States. 


As Chair of the ISC, I am pleased to introduce the new document titled Planning and Response 
to an Active Shooter: An Interagency Security Committee Policy and Best Practices Guide (non- 
FOUO). The For Official Use Only (FOUO) version of this document was initially released to 
the Federal community only in July 2015. It streamlined existing ISC policy on active shooter 
incidents into one cohesive policy and guidance document to enhance preparedness for an active 
shooter incident at Federal facilities. The non-FOUO version is being made publicly available as 
a reference document for the private sector so that a wider audience may benefit from the 
information presented herein. 


In many cases, active shooter incidents can be unpredictable in nature and can evolve quickly. 
As such, a number of guidance documents exist on how to prepare for and respond to an active 
shooter incident. Although previous ISC documents discussed active shooter incidents, such as 
the Violence in the Federal Workplace: A Guide for Prevention and Response and Occupant 
Emergency Programs: An Interagency Security Committee Guide, this single cohesive document 
with greater concentration on active shooter incidents serves as a resource for Federal agencies 
and departments, and enhances preparedness for an active shooter incident in a Federal facility. 


This policy and guidance, approved with full concurrence of the ISC primary members, is a 
significant milestone and represents exemplary collaboration across the ISC and among the ISC 
Active Shooter Working Group in developing the first ISC document combining policy and 
planning guidance. This Policy and Best Practices Guide was approved November 12, 2015 and 
will be reviewed and updated as needed. 


Caitlin Durkovich 
Assistant Secretary 
Infrastructure Protection 
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ISC Policy 
INTENT: 


The policy outlined herein is meant to establish baseline agency/department protocols across the 
Federal government for active shooter situations. The Interagency Security Committee (ISC), 
under the authority of Presidential Executive Orders 12977 and 13286, mandates that the 
following policy be enacted at all nonmilitary Federal facilities.’ Additionally, wherever 
possible, it is recommended that Agencies commit to the implementation of the best practices 
outlined in the subsequent sections of this document: Planning and Response to an Active 
Shooter: An Interagency Security Committee Policy and Best Practices Guide. 


POLICY: 


1) Each facility shall have an active shooter’ preparedness plan, which is to be updated 
every two years, as needed. At a minimum, a plan should comprise the following 
elements: 

a. Security Assessments 

Preparedness 

Communication 

Incident Plan (i.e., actions to take during an incident) 

Training and Exercises 

Post Incident Recovery 

i. Employees 
ii. Operations 

2) As plans are drafted, reviewed, and updated, each facility Designated Official or designee 
shall collaborate with the facility security provider (e.g. Federal Protective Service [FPS], 
U.S. Marshals Service [USMS], etc.), on-site law enforcement agencies (if applicable), 
and first responder agencies likely to address an active shooter situation. 

3) Agency representatives shall collaborate with other tenants/agencies in development of 
the plan. 


mo aos 


' The policy outlined herein is a requirement of all agencies within the Executive Branch of the Federal government. 
Although this is not a requirement for agencies of the Legislative and Judiciary Branches, the ISC strongly 
recommends that agencies within those branches of government also implement this policy. 


* An active shooter is defined as an individual actively engaged in killing or attempting to kill people in a populated 
area. While the majority of incidents involve the use of firearms, for the purposes of this policy, the term “active 
shooter” may also apply to an individual armed with any other type of weapon (e.g., firearm, knife, explosives, etc.). 
Throughout this policy and the subsequent best practices guidance, the ISC will use the term “active shooter” to 
describe any incident with a perpetrator who poses an active threat. 
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4) Agency representatives shall provide training, materials, and/or awareness discussions to 
inform employees of active shooter preparedness plans as they are updated. 

a. Employees should be aware of the Federally-endorsed run, hide, fight? concept. 

b. Employees should be informed of the importance of having a personal plan. 

c. New employees should be given active shooter preparedness training during the 
initial onboarding period. 

5) The active shooter plan need not be a stand-alone document. The agency/facility security 
officials and/or Designated Official will determine the best way to incorporate the active 
shooter plan into existing protocols. 

6) As previously noted, the six points above are policy requirements for all agencies within 
the Executive Branch of the Federal government. What follows throughout the rest of this 
document is a set of best practices and recommendations which are not policy 
requirements—these are meant to assist with the implementation of an active shooter plan 
as mandated by this policy. 


> Run, Hide, Fight video with closed captioning option: http://www. fbi.gov/about-us/cirg/active-shooter-and-mass- 
casualty-incidents/run-hide-fight-video. The video is also available in multiple languages. 
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Executive Summary 


The primary mission of the ISC Active Shooter Working Group is to streamline existing ISC 
documents on active shooter into one cohesive policy and guidance document that agencies 
housed in Federal facilities can use as a reference to enhance prevention, protection, mitigation, 
response, and recovery efforts related to an active shooter incident.* The goal of the ISC’s Active 
Shooter Working Group is to promote the highest chance of victim and responder survivability 
through awareness, prevention, education, and training. 


This guidance is designed to be applicable to all buildings and facilities in the United States 
occupied by Federal employees. These include existing buildings, new construction, or major 
modernizations; facilities owned, or being purchased, or leased; stand-alone facilities; Federal 
campuses; where appropriate, individual facilities on Federal campuses; and special-use 
facilities. 


Due to the nature of an active shooter event, this document contains guidance for all who might 
be involved, including law enforcement agencies, facility tenants, and the public. Certain 
responsibilities outlined within this document are specific to designated law enforcement officers 
or personnel possessing the authority and training to take immediate action to contain, 
apprehend, or neutralize an active threat. Other sections of this document are meant to educate 
facility tenants regarding actions they can take to save themselves or others. 


“The FOUO version of this document was initially released to the Federal community in July 2015. It streamlined 
existing ISC policy on active shooter incidents into one cohesive policy and guidance document to enhance 
preparedness for an active shooter incident at Federal facilities. The non-FOUO version is being made publicly 
available as a reference document for the private sector. It is generally outside the scope of the ISC to promulgate 
policies and/or best practices for the private sector. However, the ISC has released this document so that a wider 
audience may benefit from the information presented herein. References to Federal facilities have not been removed. 
The private sector and other non-government entities may interpret this document as appropriate to their specific 
facility security plans. 
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1 Introduction to Planning Guidance 


Our Nation’s Federal agencies are entrusted with providing a safe and secure environment for 
our government’s most essential functions and assets, including the personnel that may occupy 
their facilities and the public that may pass through conducting business with the Federal 
government on any given day. Federal facilities are faced with planning for emergencies of all 
kinds, ranging from active shooters, hostage situations, and other similar security challenges, as 
well as natural threats to include fires, tornadoes, floods, hurricanes, earthquakes, and pandemics 
of infectious diseases. Many of these emergencies occur with little to no warning; therefore, it is 
critical for all facilities to plan in advance to help ensure the safety, security, and general welfare 
of all facility occupants. 


The primary mission of the Interagency Security Committee (ISC) Active Shooter Working 
Group is to streamline existing ISC policy on active shooter incident planning and response into 
one cohesive policy and guidance document that agencies housed in Federal facilities can use as 
a reference to enhance preparedness for an active shooter incident. 


The ISC defines Federal facilities as buildings and facilities in the United States occupied by 
Federal employees for nonmilitary activities. These include existing buildings, new construction, 
or major modernizations; facilities owned, to be purchased, or leased; stand-alone facilities, 
Federal campuses, and where appropriate, individual facilities on Federal campuses; and special- 
use facilities. 


This document provides emergency planners, disaster committees, executive leadership, and 
others involved in emergency operations planning with detailed discussions of unique issues 
faced in Federal facilities before, during, and after an active shooter event. Occupant Emergency 
Plans should be living documents that are routinely reviewed and updated to consider all types of 
hazards, including the possibility of workplace violence, an active shooter, or terrorist incident. 
As our Nation continues to draw on lessons learned from actual emergencies, Federal facilities 
should incorporate those lessons learned into existing, or newly created, plans and procedures. 


2 Background 


The frequency of active shooter incidents has increased in recent years, and these incidents have 
affected numerous places where citizens congregate, such as schools, workplaces, places of 
worship, shopping malls, public meetings, and movie theaters. Unfortunately, these events 
highlight the need to reduce the risk of active shooter incidents while improving preparedness 
and strengthening ongoing efforts intended to prevent future occurrences. 


The ISC defines an active shooter as an individual or individuals actively engaged in killing or 
attempting to kill people in a populated area. In most cases, firearms are the weapon of choice 
during active shooter incidents, but any weapon (such as a knife, etc.) can be used to harm 
innocent individuals. Typically, there is no pattern or method to the selection of victims. Active 
shooter situations are dynamic and quickly evolve. Often, the immediate deployment of law 
enforcement is required to stop the aggressive action of a shooter to mitigate harm to potential 
victims. However, because active shooter situations are also frequently over prior to the arrival 
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of law enforcement, individuals must be prepared both mentally and physically to deal with an 
active shooter situation prior to law enforcement arrival. 


Agencies continue to evaluate active shooter events in an attempt to generate a profile of an 
active shooter. There are no hard links to provide an accurate profile of an active shooter. 
Though there is no profile, there are several possible indicators that can give clues to the 
possibility of a potential active shooter; see Section 5: Preparedness. Continuous evaluation of 
these events is necessary and should be aimed at the detection, management, and resolution of an 
impending crisis in order to effectively exercise early prevention mechanisms. A good basic 
document is the 2014 Texas State University and Federal Bureau of Investigation’s (FBI) A 
Study of Active Shooter Incidents, 2000 - 2013° (see key research findings on page 4). 


The ISC Active Shooter Working Group’s primary mission was to develop one cohesive active 
shooter document that agencies housed in Federal facilities can use as a reference to enhance 
preparedness for an active shooter incident(s). This document may also be useful to other local 
jurisdictions across the United States. 


National preparedness efforts, including planning, are based on Presidential Policy Directive 
(PPD) 8: National Preparedness, which was signed by President Obama in March 2011. This 
directive represents an evolution in our collective understanding of national preparedness based 
on lessons learned from natural disasters, terrorist acts, active shooter events, and other violent 
incidents. 


PPD-8 characterizes preparedness using five mission areas: prevention, protection, mitigation, 
response, and recovery. Emergency management officials and emergency responders engaging 
with Federal facilities are familiar with this terminology. These mission areas generally align 
with the three temporal frameworks (time frames) associated with an incident: pre-incident, 
incident, and post-incident environments. Most of the prevention, protection, and mitigation 
activities generally occur before or are modified after an incident, although these three mission 
areas are frequently applicable during an incident. For example, injury prevention can and should 
occur before, during, and after an incident. Response activities occur during an incident, while 
recovery activities can begin during and after an incident. 


Planning teams at Federal facilities responsible for developing and revising occupant emergency 
plans and procedures should use the concepts and principles of the National Incident 
Management System (NIMS) to incorporate planning efforts into existing emergency programs 
and plans that are related to active shooter incidents and other hostile threats. One component of 
NIMS is the Incident Command System (ICS), which provides a standardized approach for 
incident management, regardless of cause, size, location, or complexity of the event. By using 
the ICS during an incident, Federal facilities will be able to work more effectively with the first 
responders in their communities.° 


` The study can be found at: http://www. fbi.gov/news/stories/2014/september/fbi-releases-study-on-active-shooter- 
incidents/fbi-releases-study-on-active-shooter-incidents?utm_campaign=email- 
Immediate&utm_medium=email&utm_source=fbi-top-stories&utm_content=359177. 


ê For more information on the National Incident Management System and the Incident Command System, please see 
http://www.fema.gov/national-incident-management-system. 
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Examples of recommended practices and matters to consider have been included in this 
document for planning and implementation purposes; however, Federal facility emergency 
managers—with the support of their leadership and in conjunction with local emergency 
managers and responders—must consider what is most appropriate for that facility and its 
occupants. Additionally, planning teams should consider Federal, state, and local laws and 
regulations. 


There are various documents, studies, and websites devoted to the awareness of active shooter 
incidents; reference Section 9: Resources/Templates for a list of resources and links that may be 
useful in developing or reviewing active shooter plans. These websites are constantly evolving 
and being updated as lessons are learned. The resources vary in content, ranging from providing 
an overview of past shooting incidents, findings, a background analysis of the shooter, weaponry 
used, resolution of events, training, equipment, and best practices. The inclusion of certain 
references does not imply endorsement of any documents, products, or approaches. Other 
resources may be equally helpful and should be considered in creating or revising existing plans 
and procedures. 
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Figure 1: Key Research Findings” ® 


160 Active Shooter incidents occurred between 2000 and 2013. 

An average of 11.4 incidents occurred annually: an average of 6.4 annually in the first 
seven years of the study and an average of 16.4 annually in the last seven years. 
Shootings occurred in 40 of 50 states and the District of Columbia. 

The 160 incidents resulted in 1,043 casualties: 486 killed and 557 wounded, not 
including the shooter. 

In incidents, the median number of people killed was two, the median wounded was 
two. 


Approximately 60 percent of the incidents ended before police arrived. 

64 (40 percent) of the incidents ended with the shooter committing suicide. 

In 21 incidents (13.1 percent), the incident ended after unarmed citizens safely and 
successfully restrained the shooter. Of note, 11 of the incidents involved unarmed 
principals, teachers, other school staff, and students who confronted shooters to end the 


threat. 

In 45 of the 160 (28.1 percent) incidents, law enforcement had to engage the shooter to 
end the threat. In 21 of those 45 (46.7 percent) instances, law enforcement suffered 
casualties with nine killed and 28 wounded. 

In 64 cases where the duration could be ascertained, 44 (69 percent) ended in less than 
five minutes with 23 ending in two minutes or less. 

In five incidents (3.8 percent) the shooting ended after armed individuals who were not 
law enforcement personnel exchanged gunfire with the shooters. 

Active shooter incidents occurred most frequently in areas of commerce (46 percent), 
followed by educational environments (24 percent), and government properties (ten 
percent). 


Blair, J. Pete, and Schweit, Katherine W. (2014). A Study of Active Shooter Incidents, 2000 - 2013. Texas State 
University and Federal Bureau of Investigation, U.S. Department of Justice, Washington D.C. 2014., 

http://www. fbi.gov/news/stories/2014/september/fbi-releases-study-on-active-shooter-incidents/fbi-releases-study- 
on-active-shooter-incidents?utm_campaign=email-Immediate&utm_medium=email&utm_source=fbi-top- 
stories&utm_content=359177 


è Note: this study examines all active shooter incidents occurring in the United States, not just those at Federal 
facilities. The FBI identifies the criteria for an active shooter event as “individuals actively engaged in killing or 
attempting to kill people in populated areas (excluding shootings related to gang or drug violence).” The study 
contains a full list of the 160 incidents used, including those that occurred at Virginia Tech, Sandy Hook Elementary 
School, the U.S. Holocaust Memorial Museum, Fort Hood, the Aurora (Colorado) Cinemark Century 16 movie 
theater, the Sikh Temple of Wisconsin, and the Washington Navy Yard. 
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3 Applicability and Scope 


Pursuant to the authority granted to the ISC in Section 5 of Executive Order (EO) 12977, as 
amended by EO 13286, this ISC guidance is intended to be a reference document to provide 
agencies with enhanced preparedness for an active shooter incident. The goal of the ISC’s Active 
Shooter Working Group was to promote the highest chance of victim and responder survivability 
through awareness, prevention, education, and training. 


This guidance was designed to be applicable to all buildings and facilities in the United States 
occupied by Federal employees. These include existing buildings, new construction, or major 
modernizations; facilities owned, being purchased, or leased; stand-alone facilities; Federal 
campuses; where appropriate, individual facilities on Federal campuses; and special-use 
facilities. 


Due to the nature of an active shooter event, this document contains guidance for all who might 
be involved in an active shooter event, including law enforcement agencies, facility tenants, and 
the public. Certain responsibilities outlined within this document are specific to designated law 
enforcement officers or personnel possessing the authority and training to take immediate action 
to contain, apprehend, or neutralize an active threat, while other sections of this document are 
meant to educate facility tenants. 


4 Incorporating Active Shooter Considerations into 
the Occupant Emergency Program 


A mutually supportive relationship exists between the risk management process, facility security 
assessments, and the Occupant Emergency Program (OEP). The OEP establishes basic 
procedures for safeguarding lives and property in and around the facility during emergencies.” 41 
Code of Federal Regulations (CFR) requires Federal agencies to have an OEP.” The OEP 
should contain the Facility Security Plan (FSP) and the Occupant Emergency Plan (OEP). As 
mandated by 41 CFR, facility Designated Officials are responsible for establishing, staffing, and 
training an Occupant Emergency Organization (OEO) which will develop, implement, and 
maintain the OEP. 


Once risks to a facility are accurately assessed, including those posed by an active shooter event, 
facility security managers and Designated Officials can determine whether countermeasures in 
place are adequate to mitigate those risks or whether additional countermeasures are required. 
Procedural, programmatic, and physical security countermeasures resulting from the facility 
security assessment regarding active shooter events and other emergency situations should be 
included in the Occupant Emergency Program, Occupant Emergency Plan,” and Facility 


? For more information, see Occupant Emergency Programs: An Interagency Security Committee Guide, March 
2013. The guide can be accessed at: http://www.dhs.gov/publication/isc-occupant-emergency-programs-guide. 


1° 41 CFR 102-74.230 through 102-74.260 


1 As differentiated from the occupant emergency program, an occupant emergency plan is a document describing 
the actions occupants should take to ensure their safety in a particular emergency situation. 
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Security Plan. These plans are intended to minimize the risk to personnel, property, and other 
assets within the facility if an incident occurs inside or immediately surrounding the facility by 
providing facility-specific response procedures for occupants to follow.” 


Since the September 11, 2001 attacks, various Presidential Directives and Executive Orders have 
been issued requiring Federal agencies to develop and implement plans, policies, and procedures 
for dealing with and responding to emergency situations. Agencies can use existing guidance 
such as OEPs, disaster response plans, and Continuity of Operations (COOP) plans when 
developing an active shooter or workplace violence prevention program and plan. As with any 
threat or hazard that is included in an OEP, goals, objectives, and courses of action should be 
established for an active shooter response plan. These plans should be included in the OEP as an 
addendum or a functional annex. For example, evacuation will be different during an active 
shooter incident than it would be for a fire. 


Incorporating the concept of facility protection into the site’s OEP can help reduce the likelihood 
of workplace violence incidents (including active shooter scenarios), increase the effectiveness 
of response, and limit casualties. Most acts of workplace violence occur as some form of verbal 
or non-verbal threat, bullying, harassment, or non-fatal physical assault. However, it is important 
to remember acts of physical workplace violence might start as some form of non-physical 
assault, so agencies must take all threats seriously and respond appropriately. It is also important 
to note a threat will not lead to a violent act in the great majority of cases. The threat itself, 
however, damages workplace safety and must be addressed. 


While active shooter events are rare, the random and unpredictable nature of the threat and 
operating area present a complex challenge to Federal security and law enforcement personnel. 
Ideally, Federal security and law enforcement will deter and prevent active shooter attacks 
altogether. Should deterrence and prevention fail, however, occupant knowledge and application 
of emergency procedures and protective actions will save lives. Therefore, an OEP that 
delineates procedures to protect life and property in federally occupied space during emergency 
conditions is an essential tool, both before and during an active shooter incident. 


Plans should be created with input from internal and external stakeholders. Internal stakeholders 
may include leadership, security, facility owners and operators, property managers, the human 
resources department, risk managers, and the training department. External stakeholders should 
include local police, emergency medical services (EMS), emergency management, and fire 
personnel. 


An effective active shooter plan will include the following: 


e Proactive steps that can be taken by facility tenants to identify individuals who may be on 
a trajectory to commit a violent act. 


e A preferred method for reporting active shooter incidents, including informing all those 
at the facility or who may be entering the facility. 


e How to neutralize the threat and achieve life safety objectives. 


' For more information, see Occupant Emergency Programs: An Interagency Security Committee Guide, March 
2013. The guide can be accessed at: http://www.dhs.gov/publication/isc-occupant-emergency-programs-guide. 
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e Evacuation, shelter-in-place, hide, and lockdown policies and procedures for individual 
offices and buildings. 


o Emergency escape procedures and route assignments (e.g., floor plans, safe 
areas), including where to evacuate and how to evacuate when the primary 
evacuation routes are unusable. 


= Plans should clearly explain shelter-in-place and lockdown procedures, 
including the differences between the two. 


o Howto select effective “hide” locations. 


= Optimal locations have ballistic protection known as “cover” which 
include thick walls made of steel, cinder block, or brick and mortar; solid 
doors with locks; and areas with minimal glass and interior windows. 
These areas can be stocked with accessible first aid and emergency kits 
designed for hemorrhage control, communication devices, and telephones 
and/or duress alarms. 


= Designated “shelter-in-place” locations are often designed for natural 
hazards (earthquakes, tornadoes, etc.) and may not be ideal for active 
shooter incidents. Facilities and/or agencies should consider the 
development of safe rooms when selecting or renewing a leased facility or 
new construction. See below for a discussion of safe rooms. 


O Personnel involved in such planning should ensure all sheltering sites and 
evacuation routes are accessible for persons with disabilities. 


e Integration with the facility incident commander and the external incident commander. 


e Information concerning local area emergency response agencies and hospitals (i.e., name, 
telephone number, and distance from the location), including internal phone numbers and 
contacts. 


e How operations will be restored. 


After the procedures are approved, occupant personnel should become intimately familiar with 
the OEP and active shooter plan through training and exercises before an emergency strikes. 
Drills and exercises should occur at least annually but preferably more frequently. For building- 
specific risk assessments, reference the Risk Management Process for Federal Facilities: An 
Interagency Security Standard.” 


4.1 Challenges 


Preparing for and responding to an active shooter incident at Federal facilities poses unique 
challenges. Prior to finalizing or updating incident plans, the agency/facility officials should 
expect to confront many potential difficulties. These challenges include but are not limited to: 


'S The standard can be found at: http://www.dhs.gov/sites/default/files/publications/ISC_Risk-Management- 
Process_Aug_ 2013.pdf. 
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facility size, facility population, existing security practices, agency mission, child care centers, 
protection of sensitive and classified information, interaction with the public (e.g., visitor 
centers, courts, multi-tenant facilities), campus environments, areas of ingress and egress, and 
mixed-use spaces (e.g., retail shops). It is important to note that each site will pose a unique set 
of challenges. For this reason, it is important that each facility’s active shooter preparedness plan 
is tailored to address the particularities posed by the site. 


Addressing these challenges requires coordination between facility managers, security personnel, 
emergency management personnel, employees and Federal, state, and local law enforcement. 
Agencies housed in Federal facilities can use this ISC guidance document to mitigate and 
prepare for an active shooter incident and to promote the highest chance of victim and responder 
survivability through awareness, prevention, and education. 


5 Preparedness 


A major component of any active shooter program or plan is preparedness. This section focuses 
on measures that can be taken to reduce the risk of violent behavior; as well as mitigate the 
impacts of violent behavior should it occur. All workplace violence prevention, including active 
shooter programs, should meet minimum requirements set forth in Section 19 of the 
Occupational Safety and Health (OSH) Act of 1970, EO 12196, and the basic program elements 
under 29 CFR Part 1960. 


The 2013 Report on the National Summit on Multiple Casualty Shootings“ identified five non- 
linear components of mass casualty violence prevention: 


e Identifying a person posing a potential threat of violence; 
e Notifying the appropriate authorities with this information; 
e Evaluating the threat credibility; 
e Intervening to prevent the threat; and 
e Documenting the intervention and disseminating the information within applicable 
laws and regulations. 
Internal and external partners, programs, and processes can assist with these steps. 


No profile exists for an active shooter; however, research indicates there may be signs or 
indicators. Facility employees should learn the signs of a potentially volatile situation that could 
develop into an active shooter incident. Each employee should be empowered to proactively seek 
ways to prevent an incident with internal resources or additional external assistance. 


14 Paparazzo, John, Christine Eith, and Jennifer Tocco. 2013. Strategic Approaches to Preventing Multiple Casualty 
Violence: Report on the National Summit on Multiple Casualty Shootings. Washington, D.C.: U.S. Department of 
Justice, Office of Community Oriented Policing Services. 
https://www.fletc.gov/sites/default/files/imported_files/publications/summits-on-preventing-multiple-causality- 
violence/e021311546_ MultiCasualty-Violence_v508_05APR13.pdf. 
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By highlighting pre-attack behaviors displayed by past offenders, researchers have sought to 
enhance the detection and prevention of tragic events, including active shooter situations. Several 
agencies within the Federal government continue to explore incidents of targeted violence in an 
effort to identify these potential “warning signs.” Lessons learned from incidents during the last 
decade have aided first responders in better understanding how these incidents occur and how to 
prevent them. 


While current studies are underway, past research has proven a valuable resource. For example, 
in 2002, the FBI published a monograph on workplace violence, including problematic behaviors 
of concern that may telegraph violent ideations and plans.” In 2010, the U.S. Secret Service 
(USSS), U.S. Department of Education, and the FBI collaborated to produce the report Campus 
Attacks: Targeted Violence Affecting Institutions of Higher Education, which examined lethal or 
attempted lethal attacks at U.S. universities and colleges from 1900 to 2008.'° The report 
featured several key observations related to pre-attack behaviors, including the following: 


e Concerning behaviors were observed by friends, family, associates, professors, or law 
enforcement in 31 percent of the cases. These behaviors included, but were not limited to, 
paranoid ideas, delusional statements, changes in personality or performance, disciplinary 
problems on site, depressed mood, suicidal ideation, non-specific threats of violence, 
increased isolation, “odd” or “bizarre” behavior, and interest in or acquisition of 
weapons. 


e Inonly 13 percent of the cases did subjects make verbal and/or written threats to cause 
harm to the target. These threats were both veiled and explicit and were conveyed 
directly to the target or to a third party about the target. 


e In 19 percent of the cases, stalking or harassing behavior was reported prior to the attack. 
These behaviors occurred within the context of a current or former romantic relationship 
and in academic and other non-romantic settings. They took on various forms, including 
written communications (conventional and electronic), telephone contact, and harassment 
of the target and/or the target’s friends and/or family. Subjects also followed or visited 
the target(s) or their families or damaged property belonging to the target(s) or their 
families prior to the attack. 


e Inonly 10 percent of the cases did the subject engage in physically aggressive acts 
toward the targets. These behaviors took the form of physical assault, menacing actions 
with weapons, or repeated physical violence to intimate partners. 


Specialized units in the Federal government, such as the FBI’s Behavioral Analysis Unit (BAU), 
continue to support behaviorally-based operational assessments of persons of concern in a 


1° Workplace Violence: Issues in Response. U.S. Department of Justice, FBI Academy. 2002. 
http://www. fbi. gov/stats-services/publications/workplace-violence. 


16 Campus Attacks: Targeted Violence Affecting Institutions of Higher Education. Joint publication of U.S. Secret 
Service, U.S. Department of Education, and Federal Bureau of Investigation. 2010. 
http://rems.ed.gov/docs/CampusAttacks_201004.pdf. 


Vossekuil, Bryan, et al. The Final Report and Findings of the Safe School Initiative: Implications for the Prevention 
of School Attacks in the United States. Washington D.C.: U.S. Department of Education and U.S. Secret Service, 
2004. 
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variety of settings (e.g., schools, workplaces, places of worship, etc.) who appear to be on a 
trajectory towards violence. A review of current research, threat assessment literature, and active 
shooting incidents, combined with the extensive case experience of the BAU, suggests that there 
are observable pre-attack behaviors that, if recognized, could lead to the disruption of a planned 
attack.” While checklists of various warning signs are often of limited use in isolation, the FBI 
has identified some behavioral indicators that should prompt further exploration and attention 
from law enforcement and/or facility security. These behaviors often include: 


e development of a personal grievance; 

e contextually inappropriate and recent acquisitions of multiple weapons; 

e contextually inappropriate and recent escalation in target practice and weapons training; 
e contextually inappropriate and recent interest in explosives; 


e contextually inappropriate and intense interest or fascination with previous shootings or 
mass attacks; and 


e experience of a significant personal loss (whether real or perceived) in the weeks and/or 
months leading up to the attack, such as a death, breakup, divorce, or loss of a job. 


Few offenders had previous arrests for violent crimes. 


The profile of an applicant for a security clearance could contain indicators of possible future 
psychological or behavioral abnormalities. For this reason, investigators and screeners should be 
aware of such behavioral patterns revealed during an applicant’s examination. If not of sufficient 
magnitude for immediate rejection of the clearance, additional examination should focus on the 
questionable elements that suggest a potential problem. These findings should be recorded and 
reported to the proper officials. 


5.1 Reporting Indicators, Warnings, and Incidents of 
Workplace Violence 


Procedures for reporting violent incidents vary according to the type and intensity of violence 
involved; most Federal workplaces have a variety of reporting options. Depending on the nature 
of the situation, available resources, and the need for security/law enforcement involvement, the 
report may be made by or be provided to: 


17 Calhoun, Frederick and Stephen Weston. Contemporary Threat Management: A Practical Guide for Identifying, 
Assessing, and Managing Individuals of Violent Intent. San Diego, CA: Specialized Training Services. 2003. 


Deisinger, Gene, et al. The Handbook for Campus Threat Assessment and Management Teams. Stoneham, MA: 
Applied Risk Management. 2008. 


Fein, Robert, et al. Threat Assessment: An Approach to Prevent Targeted Violence. Washington, DC: U.S. 
Department of Justice, Office of Justice Programs, National Institute of Justice. 1995. 


Monahan, John, et al. Rethinking Risk Assessment: The MacArthur Study of Mental Disorder and Violence. New 
York, NY: Oxford University Press. 2001. 


Planning and Response to an Active Shooter 10 


e the employee’s manager; 
e the employee’s colleagues and co-workers; 
e in-house security; 


e Human Resources or organizations such as Equal Employment Opportunity (EEO), 
Sexual Assault Response Coordinator, or other Federal equivalent, etc.; 


e threat assessment team; 

e appropriate agency security (e.g., personnel security, adjudicators, etc.); 
e Federal Protective Service (FPS); 

e local mental health agencies or crisis intervention organizations; or 

e local police departments. 


In addition to established reporting procedures, agencies should allow employees who have 
safety or reprisal concerns to submit anonymous (to the extent possible) reports. Regardless of 
the specific reporting procedures, maintaining a successful violence prevention and response 
program requires agencies to investigate all reports and follow up with the appropriate actions 
where necessary. However, agencies should keep in mind that if there is no complainant, a law 
enforcement entity may feel there is no crime to investigate. 


Accurate and early reporting that allows for a well-timed intervention can be instrumental in 
resolving issues of workplace incivility and bullying before they have the opportunity to escalate 
into physical violence. Developing and implementing reporting procedures for workplace 
interpersonal issues are just as important as establishing procedures for reporting physical 
violence. Employees who feel they are victims of bullying, verbal or electronic harassment/cyber 
bullying (e.g., emails, text messages, web pages), psychological violence, emotional abuse, or 
any type of domestic violence need to report the problem, as these behaviors can have negative 
impacts on the victim, work environment, and employee productivity. Employees should be 
encouraged to document the incidents in order to assist with remembering details, dates, and 
frequency of the incidents. 


Early reporting of perceived abuse allows management to quickly address and correct a problem 
before it becomes more severe. The level of the management chain where an employee reports 
this type of violence will depend on who is committing the violence. If a direct supervisor is the 
perpetrator, then the employee needs to move up one or more levels on the management chain to 
report the violence. Additionally, employees need to be encouraged to report these incidents and 
be ensured of non-reprisal. It is recommended that a system be created, if not already in place, so 
that employees have the opportunity to speak to someone (non-affiliated in the reporting chain) 
who can determine the appropriate measures (e.g., counseling, reporting etc.) and to whom the 
incident is to be reported. 


5.2 Threat Assessment Teams 


Research shows that perpetrators of targeted acts of violence engage in both covert and overt 
behaviors prior to the attacks. Another resource most agencies can use to identify, evaluate, and 
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address these troubling signs is a multidisciplinary Threat Assessment Team (TAT). The Threat 
Assessment Team’s objective is to use internal agency specialists (which could include personnel 
from the internal security office, Office of the Inspector General, Office of the Chief Human 
Capital Officer, Office of General Counsel, etc.) to prevent violence from occurring. Members 
are responsible for addressing threats, confronting violent behavior, and assisting in assessing 
potential for violence. TAT members consider, plan, prepare, share, and, in some cases, move on 
to action. The TAT serves as a central convening body that ensures that warning signs observed 
by multiple people are not considered isolated incidents and do not slip through the cracks, as 
they actually may represent escalating behavior that is a serious concern. 


Federal entities should keep in mind, however, the importance of relying on factual information 
(including observed behavior) and avoid unfair labeling or stereotyping to remain in compliance 
with civil rights, privacy, and other applicable Federal and state laws. TATs are already an 
established protocol in most educational settings and have proven quite valuable. TATs were 
pushed to the forefront of concern following the 2007 shooting at Virginia Polytechnic Institute 
and State University in Blacksburg, Virginia, where 32 individuals were killed. For smaller 
facilities who do not have this capability and would like to utilize a TAT, look to the parent 
agency for support, or the possibility of partnering with other federal agencies who utilize a 
TAT. 


For the purposes of consistency and efficiency, a TAT should be developed and implemented in 
coordination with applicable Federal policies and practices. A TAT with diverse representation 
will often operate more efficiently and effectively. Team members may consist of human 
relations/labor relations personnel, security specialists, supervisors or managers, medical and 
mental health professionals, general counsel, and employee assistance specialists. In addition, 
any other individuals or groups within the Federal organization already working to identify staff 
needs can be a critical source of information on troubling behavior for a TAT. 


The TAT reviews disconcerting or threatening behavior of employees, visitors, staff, or other 
persons brought to their attention. The TAT utilizes a holistic assessment and management 
strategy that considers the many aspects of the potentially threatening person’s life—familial, 
work, social, academic, and residential. More than focusing on warning signs or threats alone, 
the TAT assessment involves a unique overall analysis of changing and relevant behaviors. The 
TAT takes into consideration, as appropriate, information about behaviors, various kinds of 
communications, information that has not been substantiated, any threats made, security 
concerns, family issues, or relationship problems that might involve a troubled individual. The 
TAT also may identify any potential victims with whom the individual may interact. Once the 
TAT identifies an individual who may pose a threat, the team will identify a course of action for 
addressing the situation. The appropriate course of action— whether law enforcement 
intervention, counseling, or other actions—will depend on the specifics of the situation. 


Law enforcement can help assess reported threats or troubling behavior quickly and privately 
and reach out to available Federal resources as part of the TAT process or separately. The FBI’s 
behavioral experts in its National Center for the Analysis of Violent Crime (NCAVC) at 
Quantico, Virginia, are available on a 24/7 basis to join in any threat assessment analysis and 


'8 Team members should be cognizant of Health Insurance Portability and Accountability Act (HIPAA) Privacy 
Rules. Reference Section 9: Resources/Templates for a link to HIPAA information and privacy pocket cards. 
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develop threat mitigation strategies for persons of concern. The law enforcement member(s) of 
the TAT should contact the local FBI office for this behavioral analysis assistance. 


Each FBI field office has an NCAVC representative available to work with TATs and coordinate 
access to the FBI’s BAU, home to the NCAVC. For non-Federal entities, the FBI supports 
requests that are made through local police departments. The analysis focuses not on how to 
respond tactically to an active shooter incident but rather on how to prevent one. Early 
intervention can prevent a situation from escalating by identifying, assessing, and managing the 
threat. The TAT should consult with its agency’s/organization’s administration and develop a 
process to seek these additional resources. 


TATs or Federal representatives should also work with local law enforcement to gain an 
understanding of the threats from outside their agency/organization that may affect the facility so 
that, in partnership, appropriate security measures can be established. 


5.3 Employee Assistance Program 


It is important to properly implement and promote an Employee Assistance Program (EAP). The 
effectiveness of any workplace violence program that includes active shooter preparedness is 
greatly enhanced in an organization with an active, well-known EAP presence. Agencies with 
active programs promote the EAP by issuing periodic statements from top management 
endorsing the program and reminding employees of the services offered by the EAP; having 
counselors attend staff meetings to familiarize agency employees with the counselors; having 
counselors give special briefings and seminars for managers, employees, and union stewards; 
and reminding employees that by law, all services provided by the EAP are confidential. 


Active and frequent information dissemination is required to adequately support EAPs. EAPs 
often provide booklets, pamphlets, and lend libraries of books and videos about such topics as 
domestic violence, stress reduction, and dealing with angry customers. Another helpful resource 
is Violence in the Federal Workplace: A Guide for Prevention and Response.” Early 
involvement in organizational change is essential. For an agency facing reorganization, 
restructuring, or other organizational change that may have a negative effect on employees, for 
example, the EAP can help provide individual or group sessions to maintain information flow, 
keep feelings under control, prevent potential outbursts, provide constructive outlets for feelings, 
and help employees plan for the future. 


Much of the employee training described in this section is conducted by EAP staff. For example, 
counselors can train employees on topics such as dealing with angry coworkers and customers, 
conflict resolution, and communications skills. Since EAP staff understands how important it is 
that supervisors (and coworkers) not diagnose an employee’s problem, they are in an excellent 
position to explain the delicate balance between identifying problem behavior early on and 
labeling an individual as potentially violent. EAP counselors can train supervisors to deal with 
problems as soon as they surface. 


19 The guide can be accessed at: 
http://www.dhs. gov/sites/default/files/publications/ISC%20 Violence%20in%20%20the%20Federal%20Workplace 
%20Guide%20April%202013.pdf 


Planning and Response to an Active Shooter 13 


5.4 Law Enforcement and First Responder Coordination 


Federal, state, local, tribal, and territorial law enforcement personnel can be an invaluable 
resource in developing a prevention and preparedness component of an active shooter program. 
As such, it may be in the best interest of the facility and/or agency to establish a written 
memorandum of agreement with local law enforcement entities who may respond to an active 
shooter situation or other emergency. Building strong partnerships with law enforcement, fire 
personnel, and EMS includes ensuring they also know the location of available public 
announcement systems, two-way communications systems, security cameras, and alarm controls. 
Equally important is information on access to utility controls, medical supplies, and law 
enforcement equipment. Providing this detailed information to first responders allows them to 
move through a facility rapidly during an emergency, to ensure areas are safe, and to tend to 
people in need. 


6 Training and Exercises 


Training and exercises are the best activities to help prepare personnel to react quickly and 
effectively in emergency situations. When considering training options for establishing 
awareness and providing appropriate responses to the threat of an active shooter, the Federal 
agency should conduct a thorough review to identify the best training approach for their facility 
occupants. This review should assess the specific features of the facility itself along with the 
needs and capabilities of the personnel occupying the facility. 


Following the examination of the target population, a needs assessment should be conducted 
under the assumption that the risk of an active shooter event is high. Therefore, the assessment 
should formulate the most favorable actions for all persons likely to be involved, including 
community resources. Not unlike periodic fire drills, continual awareness campaigns of the 
active shooter threat can ensure a much higher chance of reacting quickly and surviving an actual 
situation. The target population should include individuals occupying or visiting the facility on a 
day-to-day basis, including security personnel, law enforcement officers, and members of the 
public frequenting the facility. Training participation opportunities should be extended to the 
external emergency responders likely to support the facility in an active shooter situation. 


Each target group has different training needs. For example, members of the general public are 
less likely to attend formal training and could be exposed to essential information through 
posters, brochures, or radio and television spot announcements. Employees would benefit from 
briefings and participation in active shooter drills. On-site law enforcement/armed security, as 
well as external responders, would benefit from hands-on scenario-based training; knowledge of 
the facilities’ physical features such as entrances, exits, and construction features; and knowledge 
of and familiarity with the capabilities of the internal security force. 


An active shooter preparedness plan should be the source document used in the development of a 
training program. If no plan exists, the information gained through the needs analysis would be 
beneficial in developing a plan. 


Once the needs are identified, a survey of existing training programs should be conducted to 
determine if a suitable training solution already exists. More often than not, training needs can be 
satisfied by an existing program from a sister agency such as FEMA or through the Federal Law 
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Enforcement Training Center (FLETC). Other courses are available through private sector and 
non-governmental entities. 


In some situations, the uniqueness of the target population may require the design and 
development of an entirely new training instrument or the modification of an existing one. This 
could involve the use of professional or experienced instructional designers if sufficient in-house 
talent is unavailable. 


6.1 Training and Awareness Material 


The method of instruction delivery depends on several factors. Instructor-led training is more 
formal and requires a time commitment from participants for the duration of the course. In some 
cases, online or web-based instruction is a suitable alternative that can reduce or alleviate 
scheduling conflicts or travel requirements. 


Posters and other visual aids illustrate key learning points and should be situated in prime 
locations at the facility. These resources remind facility occupants of the objectives of the 
training program, strengthen their retention of essential information, and ensure occupants are 
aware of the possibility of an active shooter event. 


An active shooter training video, entitled "Run, Hide, Fight” was developed and produced by 
the Houston Mayor’s Office of Public Safety and Homeland Security and funded by the U.S. 
Department of Homeland Security (see Section 7: Response for further detail). This six-minute 
video,” endorsed by multiple Federal agencies, dramatizes an active shooter incident in the 
workplace exemplifying the unpredictability and quick evolution of active shooter situations. Its 
purpose is to educate the public by demonstrating response actions during such an incident so 
that they can prepare for an active shooter situation. Active shooter events often appear 
spontaneous and evolve quickly, therefore preparation is essential. This preparation should 
include training and planning that maximizes the possibility of survival. 


In order for information to be actionable, it must be accessible. For example, visual and/or 
auditory aids and cues (such as posters, sirens, etc.) are only useful if the audience can see and/or 
hear them. For those with a hearing or visual disability, the information conveyed through these 
means may not be accessible. Partnering with local disability entities such as Americans with 
Disabilities Act (ADA) Centers, governor's disability councils, mayoral task forces, independent 
living centers, etc., for assistance with tools, methods, resources and protocols can make life 
saving differences for employees and visitors with a variety of access and functional needs or 
disabilities. 


is Run, Hide, Fight video with closed captioning option: http://www.fbi.gov/about-us/cirg/active-shooter-and-mass- 
casualty-incidents/run-hide-fight-video. The video is also available in multiple languages. 
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6.2 Occupant Self-Help and First Aid 


Facility staff may be trained in the basics of hemorrhage control so that care can be initiated as 
quickly as possible. This training can include basic information on how to improvise a bandage 
and apply direct wound pressure. Tourniquets have been shown to be lifesaving, but it is unlikely 
that commercial tourniquets will be immediately available in most circumstances. Training for 
staff could therefore include when to use a tourniquet, how to improvise a tourniquet, and the 
correct application. 


6.3 Considerations for Medical First Responders (Fire and 
EMS) 


As previously noted, it is highly recommended that facilities coordinate plans with any 
responding officials, including fire departments and emergency medical services. Medical first 
responders may already have training in the care of injuries associated with active shooter 
events. Facilities will need to collaborate with fire personnel and EMS during an active shooter 
incident. Therefore, in order to ensure facility plans do not conflict with Fire or EMS training 
and response, it is important that site officials familiarize themselves and their employees with 
the training and resources available to fire personnel and EMS organizations. 


Fire personnel and EMS entities that could respond to an active shooter event should ensure that 
they have adequate training to provide treatment or accept patients that have received treatment. 
First responders will likely need additional training on safely moving to waiting ambulances, 
ensuring a means of ambulance egress, and making transport destination decisions in case of 
multiple casualties. Whenever possible, these training programs should be developed and 
practiced in partnership with responding law enforcement agencies. 


6.4 Exercises 


Most Federal facilities practice evacuation drills for fires and take protective measures for 
tornadoes, but conduct far fewer preparedness exercises for active shooter incidents. To be 
prepared for an active shooter incident, facilities should train facility occupants and on-site 
security staff in what to expect and how to react. After conducting training sessions, it is 
absolutely essential to reinforce the classroom or on-line instruction with realistic exercises. 
Exercises should be designed for the needs of the individual agency and conducted in a manner 
that includes all people normally involved in the mitigation of an active shooter incident. People 
with disabilities and others with access and functional needs should be included in helping 
develop all phases of exercises, because they are the subject matter experts regarding their 
disabilities and needs whose life experiences will add reality to any exercise scenario. Phases of 
exercises include: concept design/development, testing/designing objectives, execution/conduct, 
evaluation, alteration and ongoing conduct, and evaluation and alteration of exercise design. 


Good planning includes conducting exercises with first responders and facility security teams, 
including any security or law enforcement officers who are employed in the facility. Valuable 
partners are one of the most effective and efficient ways to ensure that everyone knows not only 
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his or her role but also the role of others at the scene. These exercises should include a 
walkthrough of the facility to allow law enforcement officials to provide input on shelter sites 
and be familiar with hazardous areas within the facility (e.g., magnetic resonance imaging [MRI] 
devices and radioactive areas). This will also familiarize first responders with the site, including 
shelter locations, evacuation routes, and locations where they may find occupants who may be 
unable to evacuate, such as persons with access or functional needs. The facility should also 
consider and plan for how to care for the critically injured from the event. 


There are many types of exercises, starting with discussion-based exercises such as seminars and 
tabletop exercises. Activities can graduate to operations-based exercises utilizing personnel and 
equipment from multiple jurisdictions culminating in a full-scale exercise. Exercises can be 
designed to involve the entire facility population, to include local responders, or be narrower in 
scope to address a smaller portion of the facility or population. All drills and exercises should be 
announced prior to conducting them. Some recommendations for exercise programs include: 


e pre-designated assembly points for people who need assistance evacuating; 
e verified points of accessible egress; 


e internal exercise training program for all employees including volunteers to respond to 
specific assembly areas; 


e established alert and notification procedures; 
e pre-determined communications capabilities; and 


e identify employees who have current and valid credentials in EMS, law enforcement, or 
fire services that could assist safety or security officers, if needed. 


Several active shooter scenarios should be considered due to the fact that an actual event is 
unpredictable. Feedback from these exercise sessions will be valuable in determining weaknesses 
in the plan and improving both plans and training. Exercises should be conducted on a recurring 
basis to keep the active shooter threat fresh in the minds of the participants, and should include 
the latest mitigation techniques and any recent changes in the overall plan. Information for the 
design and conduct of exercises is available from FEMA’s Independent Study (IS) program.” 


FEMA Independent Study courses that would be beneficial in exercise planning and conduct: 
e [S-120.A: An Introduction to Exercises 
e [S-130: Exercise Evaluation and Improvement Planning 
e J[S-139: Exercise Design 


Planning for an OEP exercise may include the following phases: initial planning conference, 
venue selection, midterm planning conference, advanced ICS workshop, crime scene 
preservation seminar, final planning conference, controller and evaluator briefing, emergency 
exercise, controller and evaluator debriefing, recovery and restoration tabletop exercise, and 
after-action conference and lessons learned follow-up. 


21 The FEMA IS program can be accessed online via: http://www.training.fema.gov/IS. 
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7 Response 


The facility OEP should include courses of action that will describe how occupants can most 
effectively respond to an active shooter situation to minimize the loss of life and teach/train on 
these practices. When an incident occurs, it is important to follow the OEP and any instructions 
given during an incident; however, often individuals will have to rely on their own judgment to 
decide which option will best protect lives, including their own. No single response fits all active 
shooter situations; however, making sure each individual knows his or her response options and 
empowering them to react decisively will save valuable time. Depicting scenarios and 
considering response options in advance will assist individuals and groups in quickly selecting 
their best course of action. 


Understandably, this is a sensitive topic. There is no definitive best response during these 
scenarios, but maintaining a run, hide, fight mindset can increase the odds of surviving. It may 
be valuable to schedule a time for an open conversation regarding the topic at the facility. 
Though some individuals may find the conversation uncomfortable, they may also find it 
reassuring to know that as a whole their organization is thinking about how best to deal with this 
situation. 


Regardless of training or directions given, each employee, visitor, and facility occupant will react 
and respond based on his or her own instincts. Some people may not be able to leave; others may 
refuse to leave. Some will find comfort in a group; others will face the challenges alone. It would 
be difficult or impossible for a facility to inform its occupants of every eventuality. Facilities 
should help occupants understand there is no perfect response. 


Unless otherwise directed by law enforcement or other emergency personnel, the decision to stay 
or leave is something best determined by the individual. However, Federal facilities can help 
occupants better prepare, respond, and recover by discussing active shooter considerations and 
inviting employees to trust that they will make the best decision they can at the time, relying on 
their individual circumstances. During an active shooter incident, those present will rarely have 
all of the information they need to make a fully-informed decision about applying the run, hide, 
fight options. 


It is not uncommon for people confronted with a threat to first deny the possible danger rather 
than respond. A 2005 investigation by the National Institute of Standards and Technology 
(NIST) into the collapse of the World Trade Center towers on September 11, 2001 found that 
people close to the floors impacted waited longer to start evacuating than those on unaffected 
floors. Similarly, during the Virginia Tech shooting, individuals on campus responded to the 
shooting with varying degrees of urgency. These incidents highlight this delayed response or 
denial. 


When an active shooter event occurs, facility occupants will look for authority figures to provide 
guidance on what to do. They may not make a distinction between law enforcement officers and 
other uniformed personnel. In the Federal environment, uniformed personnel may be Federal 
agents or other security staff or law enforcement officers. These individuals may not be present 
when a shooting begins. Announcements of the incident may be made via building notification 
system, facility occupants, or upon hearing weapons fire. Therefore, all employees should 
receive training in techniques on responding to an active shooter event using the run, hide, fight 
model. Individuals should remain calm and try to remember the procedures they learned in 
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training. Agency training should explain/distinguish the procedural differences between 
“sheltering” for a natural disaster event versus “lockdown” for an active shooter incident. 


As the situation develops, occupants need to be trained to know how to use more than one option 
in the run, hide, fight continuum. Individuals need to decide what action is appropriate based on 
their locations. The goal in all cases is to survive and protect others, but options will depend on 
how close individuals are to the shooter. Those present can run away from the shooter, seek a 
secure place where they can hide and deny the shooter access, or incapacitate the shooter in order 
to survive and protect others from harm. In many instances, an individual might first need to hide 
and then run to safety when able. While they should follow the plan and any instructions given 
by appropriate facility representatives during an incident, they will often have to rely on their 
own judgment. The mental rehearsal of scenarios and considering response options in advance 
will assist individuals and groups in quickly selecting their best course of action. 


Staff should have an understanding of the response plan and how to lead or direct facility 
occupants to the nearest evacuation routes (run) and identified secure areas (hide). Train staff to 
overcome denial and to respond immediately. For example, train staff to recognize the sounds of 
danger, act, and forcefully communicate the danger and necessary action (e.g., “Gun! Get out!”). 
In addition, those closest to the public address or other communications system, or who are 
otherwise able to alert others, should communicate the danger and necessary action. Internal 
communications with those in the immediate situation is critical. Security officials are 
encouraged to use any means necessary, including information technology platforms, software, 
or devices (e.g., computer messaging, mobile phone applications, etc.) to disseminate 
information to the workforce in a dynamic environment. Repetition in training and preparedness 
shortens the time it takes to orient, observe, and act. Upon recognizing the danger, staff or others 
must alert responders as soon as it is safe to do so by contacting 911 with information that is as 
clear and accurate as possible. 


While personal safety is the primary consideration in any emergency, helping others to safety 
increases the survivability for all potential victims. Rendering aid can be as simple as rallying 
victims to “Follow me!” or aiding non-ambulatory persons and performing immediate first aid in 
safer areas. 


Response to an incident will involve the facility tenants (including visitors), building security 
officers (if applicable), and responding law enforcement (internal and/or outside agencies). The 
site security manager (SSM) or designated official is responsible for ensuring an active shooter 
response and communication plan is in place. If the SSM agency has armed security or law 
enforcement, they are also responsible for deploying on-site assets. The SSM should also 
coordinate with responding outside agencies (both law enforcement and EMS) to maximize 
effectiveness of any response and minimize confusion and delay. 


Remember, during an active shooter incident the natural human reaction is to be startled, feel 
fear and anxiety, and even experience initial disbelief and denial. Those present can hear noise 
from alarms, gunfire, explosions, and people shouting and screaming. Training (e.g., table top 
exercises and drills) provides the means to regain composure, recall at least some of what has 
been learned, and commit to action. Training to remember the run, hide, fight mantra improves 
the likelihood of action. 
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7.1 Run 


If it is safe to do so, the first course of action that should be taken is to run. When possible, 
individuals should exit the building through the safest route and proceed to a designated 
assembly location(s) or an alternate vetted site. However, given the dynamic nature of an active 
shooter event, exiting the building and going to an evacuation site via practiced fire drill routes 
may put individuals at risk or may not be possible. If doing so is not possible or puts individuals 
at risk, employees may need to run out of the facility or away from the area under attack and 
move as far away as possible until they are in a safe location. These options should be clearly 
conveyed to employees during facility active shooter training and/or exercises. 


Despite the complexity of this situation, facility occupants and visitors at risk who can evacuate 
safely should do so. Recent research shows the best method to reduce loss of life in an active 
shooter incident is for people to immediately evacuate or be evacuated from the area where an 
active shooter may be located or attempting to enter.” 


Staff should be trained to: 
e leave personal belongings behind; 
e put their hands in the air to signal that they are unarmed to law enforcement responders; 


e visualize possible escape routes, including physically accessible routes for occupants, 
visitors, or staff with disabilities and others with access and functional needs; 


e avoid escalators and elevators; and 
e take others with them but not stay behind because others refuse to leave. 


Call 911 when safe to do so: 


Information to provide to law enforcement or dispatchers: 
Location of active shooter(s) 
Location of caller 
Number of shooters, if more than one 
If there is law enforcement on-site (if known) 
Physical description of shooter(s) 


Type and number of weapons used by shooter(s) 


Use or threat of explosives/IEDs 


If shooting is still occurring 


Number of potential victims at the scene 


2 Blair, J. Pete, et al. Active Shooter Events and Response. Boca Raton, FL: CRC Press, Taylor & Francis Group, 
LLC. 2013. 
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Because facility occupants may scatter, they should be given directions on who they should 
contact in order to account for all personnel. 


Planners should consider creating a threat annex for the run, hide, fight scenario. While 
developing this annex, at a minimum, consideration should be given to the following questions: 


e Have primary and alternative accessible escape routes been identified? 
e Have employees rehearsed the use of escape routes? 
e Will escape routes provide enough distance, cover, and concealment to provide safety? 


e Has a system been developed to account for all personnel when it is safe to do so? 


7.2 Hide 


If running is not a safe option, staff should be trained to hide in as safe a place as possible where 
the walls might be thicker and have fewer windows. Likewise, for occupants that cannot run, 
hiding may be the only option. 


In addition, occupants should do the following: 
e Lock the doors and/or barricade them with heavy furniture, if possible. 
e Close and lock windows and close blinds or cover windows. 
e Turn off lights. 
e Silence all electronic devices. 
e Remain silent. 
e Look for other avenues of escape. 
e Identify ad-hoc weapons. 


e When safe to do so, use strategies to silently communicate with first responders, if 
possible (e.g., in rooms with exterior windows, make signs to silently signal law 
enforcement and emergency responders to indicate the status of the room’s occupants). 


e Hide along the wall closest to the exit but out of view from the hallway (which would 
allow the best option for ambushing the shooter and for possible escape if the shooter 
enters or passes by the room). 


e Remain in place until given an all clear by identifiable law enforcement. 
Consider these additional actions: 


e Identify a safe location on each floor before an incident occurs where occupants and 
visitors may safely barricade themselves during an event. 


e Train people in how to lock down an area and secure the unit, including providing a 
checklist of instructions on the back of doors and by phones. 


e Ensure emergency numbers are available at all phone locations. 
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Consider the following questions if developing a threat annex for the run, hide, fight scenario: 
e Have shelter-in-place locations been identified? 
e Is there a method to secure the access to these locations? 
e Have employees rehearsed the movement to and positioning within these locations? 


e How will communications be established with these locations? 


7.3 Fight 


If neither running nor hiding is a safe option, when confronted by the shooter individuals in 
immediate danger should consider trying to disrupt or incapacitate the shooter by using 
aggressive force and items in their environment, such as fire extinguishers, chairs, etc. Research 
shows there is strength in numbers, as indicated in the earlier mentioned study. The potential 
victims themselves have disrupted 17 of 51 separate active shooter incidents before law 
enforcement arrived.” 


Speaking with staff about confronting a shooter may be daunting and upsetting for some 
individuals, but great comfort can come from the knowledge that their actions could save lives. 
To be clear, confronting an active shooter should never be a requirement of any non-law 
enforcement personnel’s job; how each individual chooses to respond if directly confronted by 
an active shooter is up to him or her. 


Consider the following questions if developing a threat annex for the run, hide, fight scenario: 
e Have discussions about when it might be appropriate to defend been addressed? 


e Have discussions about available equipment to be used to assist in their defense been 
addressed? 


e Have discussions related to the concepts of superiority of numbers, surprise, speed, and 
violence of action been addressed? 


7.4 Run, Hide, Fight for Occupants with Disabilities 


Any actions taken during activation of the plan must be as effective for individuals with 
disabilities as those actions provided for the other occupants of the facility. When developing or 
making changes to an occupant emergency plan, it is imperative the needs of individuals with 
disabilities be addressed throughout the process. Applicable laws and regulations include but are 
not limited to: 


e The Americans with Disabilities Act of 1990; 


°° Texas State University and Federal Bureau of Investigation’s (FBI) "A Study of Active Shooter Incidents, 2000 — 
2013”: http://www. fbi.gov/news/stories/2014/september/fbi-releases-study-on-active-shooter-incidents/fbi-releases- 
study-on-active-shooter-incidents?utm_campaign=email-Immediate&utm_medium=email&utm_source=fbi-top- 
stories&utm_content=359177 . 
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The Rehabilitation Act of 1973; 
EO 12196 “Occupational Safety and Health Programs for Federal Employees” 1980; and 
EO 13347 “Individuals with Disabilities in Emergency Preparedness” 2004. 


As discussed earlier in this section, no one should be forced to stay or leave the premises during 
an active shooter situation (unless otherwise directed by law enforcement or other emergency 
personnel). Supervisors are ultimately responsible to ensure that members of their staff or 
visitors with a disability are properly taken care of during all emergency incidents. Federal 
managers and supervisors should be trained to: 


ensure those occupants identified as requiring assistance during an evacuation or shelter- 
in-place (SIP) have a customized plan that includes the assistance required, the name of 
the person(s) volunteering to assist, accountability protocol, type of equipment required 
(if any), and the evacuation route from the assigned work space; 


identify any volunteer(s) willing to assist person(s) with disabilities or needing 
assistance; and 


ensure those occupants under their supervision with self-identified assistance needs can 
be accounted for during an incident.** 


Additionally, notifications should be made in a variety of formats so that they are accessible to 
those with special needs. Proper planning and execution should consider: 


7.5 


vibrating alerts for employees who are deaf or hard of hearing; 
employees who are blind; 

alternative notification measures; 

employees whose disabilities go beyond deafness or hard of hearing; 
including people with temporary disabilities; 

visitors; 

people with limited English proficiency; 

sign cards with text and picture based emergency messages/symbols; and 


involving people with disabilities in all planning. 


Interacting with First Responders 


Facility occupants should be aware that the first priority for responding law enforcement is to 
respond to the threat, engage, and neutralize the active shooter as soon as possible; all other 
actions are secondary. One comprehensive study found that in more than half (57 percent) of 


** For more information, see Occupant Emergency Programs: An Interagency Security Committee Guide, March 


2013. 
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active shooter incidents where a solo officer arrived on the scene, shooting was still underway 
when the officer arrived. In 75 percent of those instances, that solo officer had to confront the 
perpetrator to end the threat. In those cases, the officer was shot one-third of the time.” 


Facility standard operating procedures (SOP) should address when transportation resources 
should be brought to the scene and address maintaining a transportation corridor to assist law 
enforcement and first responders. There should be guidance on prioritization of patients, use of 
treatment areas versus CCPs, and what destination hospitals may be used. 


Law enforcement, firefighters, and EMS personnel (first responders) coming to a Federal facility 
because of a 911 call involving gunfire face a daunting task. Though the objectives remain the 
same—protect and save lives—the threat of an active shooter incident differs from responding to 
a natural disaster or many other emergencies. Emergency calls can involve actual or future 
threats of physical violence. Information coming in may be inaccurate and conflicting. This 
violence might be directed not only in or at the facility and its occupants, but also at nearby 
buildings off-site. 


Active shooter incidents are one of the most dangerous situations facing law enforcement today. 
If there is active shooting, officers will assemble as a contact team, enter the facility, and proceed 
directly to the sounds of violence (gunshots, pleas for life, etc.). If no shouts or sounds of 
violence are heard, a quick and methodical search of the facility will be conducted. Should the 
gun shots start up, or sounds of violence be heard, the contact team will stop searching and 
proceed directly to this source. Facility occupants should not be alarmed if officers shout 
commands and push individuals to the ground for their safety. The first officers to arrive on the 
scene will not stop to assist with injured personnel. Rescue teams consisting of additional 
officers and, if authorized by facility/local law enforcement agency SOP, medical personnel will 
follow the first wave and will enter the facility as soon as possible. 


Occupants should be trained to cooperate and not to interfere with the response of FPS or other 
first responders. The sooner law enforcement is able to discern the threat and react, the more 
lives can be saved. This is particularly true in an active shooter incident where law enforcement 
responds to a 911 call of shots fired. Many innocent lives are at risk in concentrated areas. This is 
why it is critical that facilities work with their local partners (e.g., first responders, emergency 
managers) to identify, prepare, prevent, and effectively respond to an active shooter incident in a 
coordinated fashion. 


In actual emergencies, timely intelligence is critical. Staff should be trained to contact the police 
and share with them essential information. Law enforcement encourages all calls, and no one 
should assume that someone else has called. Video surveillance that is accessible to smart 
phones and other electronic devices must be shared with responding units as soon as practical. 


2 Blair, J. Pete, and Schweit, Katherine W. (2014). A Study of Active Shooter Incidents, 2000 - 2013. Texas State 
University and Federal Bureau of Investigation, U.S. Department of Justice, Washington D.C. 2014., 

http://www. fbi.gov/news/stories/2014/september/fbi-releases-study-on-active-shooter-incidents/fbi-releases-study- 
on-active-shooter-incidents?utm_campaign=email-Immediate&utm_medium=email&utm_source=fbi-top- 
stories&utm_content=359177 
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7.6 Roles and Responsibilities 


First and subsequent arriving resources should have clearly defined tasks and roles. This should 
include basic activation of the active shooter event response and what initial information should 
be conveyed. Roles and responsibilities should be developed by a multiagency team to ensure 
interoperability. It should include who is responsible for and when incident command should be 
established. 


7.7 Access and Staging 


When and how law enforcement officers (LEO) establish an initial contact team should be 
clearly defined in any multiagency SOP. In addition, the LEOs should have a basic 
understanding of the desirable elements of a CCP to include security, proximity to occupants, 
and routes of egress. The management of active shooter events requires early insertion of 
medical responders into a potentially hostile environment, a philosophy contrary to that 
traditionally used. When, how, and under what conditions medical responders should enter the 
scene should be clearly defined by a multidisciplinary team, integrated into the SOP, and 
communicated to all. If any ongoing threat exists, law enforcement is responsible for maintaining 
medical responder safety. LEOs should also be responsible for determining when it is safe to 
evacuate occupants or if occupants should be managed in the CCP and for placing emphasis on 
maintaining a safe evacuation route for facility personnel. 


Early identification of an active shooter event is critical to establishing an effective response. 
Federal facility staff engaged in security roles should receive training in agreed upon methods of 
notification and common terminology. 


7.8 Tenant Cooperation with Law Enforcement 


Tenants in a facility where an active shooting is taking place should keep the following in mind 
(as reinforced through training): 


(a) Quickly determine what actions to take to protect life: options include run, hide, and 
fight. Use best judgment based on the specific circumstances of the incident. 


(b) When encountering responding LEOs, remain calm and follow any and all instructions 
from the officers. Officers may shout commands and push individuals to the ground for 
his/her safety as well as their own. 


When law enforcement personnel arrive at the scene, tenants should be aware of the following: 
e Follow all official instructions from police; 
e Remain calm, think, and resist the urge to panic; 
e Immediately raise hands and spread fingers; 
e Keep hands visible at all times; 


e Put down any items; 
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e Avoid making sudden or quick movements toward officers; 
e Do not point, scream, or yell; 

e Do not ask for help from the officers when evacuating; 

e Proceed in the direction as advised by the officers; and 


e Provide all relevant information to police. 


7.9 Communications/Media Messaging 


The public affairs officer (PAO) is responsible for developing and releasing information about 
the incident to the news media, incident personnel, and other agencies and organizations, as 
appropriate. The public affairs officer at the affected facility should coordinate all external 
communications with the incident command through the joint information center (JIC). Once a 
JIC is established, a primary public affairs officer will be designated to coordinate all public 
information including that from the facility PAO. 


Planning for successful crisis communications includes the following: 
e Establish working relationships with local media and local law enforcement beforehand; 
e Frontload agency websites with mission, key leaders, etc.; 
e Have a public affairs plan (funding, backups, resources, etc.); 


e To the extent possible, develop standard talking points for senior and crisis leadership to 
use when engaging the media; 


e Get accurate information out early to avoid misinformation due to social media; 


e FBI and other local law enforcement will send public affairs specialists, as requested, in 
an assist role; 


e Include PAO in training; 
e Establish main news contacts in advance ; and 


e Have a checklist of necessary and appropriate information to provide. 


7.10 The Importance of Effective Communication in a Crisis 
Environment 


Communication during an incident is critical. Once an active shooter event has been identified, 
the response should be activated using uniform and agreed upon language by responding 
agencies. Whenever possible, communication should be in plain language. There should be a 
standardized communications plan to ensure all responding agencies are able to communicate. 
This should include establishing a common radio frequency where practical and use of common 
terms to describe actions, locations, roles, etc. Planning for active shooter events should include 
a predetermined communication plan that should be available to all agencies that may respond to 


Planning and Response to an Active Shooter 26 


an active shooter event. The presence of a communication plan is of particular importance in the 
airport environment given the number of local, state, and Federal agencies involved in the daily 
operations of that setting. Communication plans should also include early notification of the 
health care system and facilities that may be called upon to receive casualties. 


Lessons learned from past incidents include the following: 
e Always have multiple communications options; 
e Use any communication option available; 
e Do not rely on others to relay critical information; 
e Do not make assumptions of who knows what; 
e Do not assume others know what you know; 
e Do not assume you know everything you need to know; 


e Ensure all standard emergency notification is accessible in alternative formats so that all 
people have situational awareness; 


e Establish a knowledgeable liaison with the first responder command post; and 
e Communication can be a challenge despite best efforts of trained professionals. 
Training to Communicate Effectively 


Teaching managers and emergency personnel how to communicate effectively is as critical as 
training staff and management in evacuation procedures. Accessible and Section 508 compliant 
scenario-based training addressing a wide range of variables is strongly encouraged and should 
include communication with facility staff/security and first responders. ”° 


8 Recovery 


Once the active shooter has been incapacitated or apprehended and is no longer a threat, and law 
enforcement have evacuated the wounded, human resources and/or management should engage 
in post-event assessments and activities in coordination with local law enforcement and 
emergency personnel, including: 


e accounting for all individuals at one or more designated assembly points to determine 
who, if anyone, is missing or potentially injured; 


e coordinating with first responders to account for any occupants who were not evacuated; 


e determining the best methods for notifying families of individuals affected by the active 
shooter, including notification of any casualties in coordination with law enforcement; 


°° For more information on accessibility and Section 508 compliance, please visit the FEMA Office of Disability 
Integration and Coordination website at: https://www.fema.gov/office-disability-integration-and-coordination. 
Additionally, the Federal website for Section 508 compliance can be accessed at: https://www.section508.gov/. 
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e assessing the psychological state of individuals at the scene and referring them to health 
care specialists accordingly; 


e employing continuity of operations plans to ensure mission essential functions are carried 
out; and 


e determining a transition plan that includes when to resume normal operations. 


It is important to note that once the active shooter is apprehended or incapacitated, the situation 
and the location will be an active crime scene. Nothing should be touched unless it involves 
tending to the wounded. Discuss the implications of the facility as a crime scene with local law 
enforcement officials in advance. 


Facility administrators and key personnel should plan for an extended, evolving situation and the 
mass casualty or internal disaster plan may be activated to manage the continuing situation. This 
may include altering daily activities in order for law enforcement and first responders to 
adequately investigate and clear the scene and to rehabilitate the facility to an acceptable level 
for work activity. 


The OEP should identify trained personnel who will provide assistance to victims and their 
families. This should include establishing an incident response team (including first responders) 
that is trained to appropriately assess victims. They will provide emergency intervention services 
and victim assistance beginning immediately after the incident and throughout the recovery 
efforts. This team will integrate with state and Federal resources when an emergency occurs. 


Federal and state laws mandate the care of victims of crimes in certain circumstances. Therefore, 
substantial resources and processes are already in place to aid victims and their families, most 
notably through state agencies, the Department of Justice (DOJ), and the FBI’s Office for Victim 
Assistance. Prior familiarity with these resources—such as existing, dedicated toll-free numbers 
for victims and their families—will permit officials to immediately provide valuable information 
to victims, victim families, staff, and others affected by the tragedy. 


8.1 Reunification 


Where the immediate reunification of loved ones is not possible, providing family members with 
timely, accurate, and relevant information is paramount. The local or regional mass fatality plan 
may call for the establishment of a family assistance center (FAC) to help family members locate 
their loved ones and determine whether or not they are among the casualties. This center should 
be placed away from media view or exposure and it is recommended the families of the victims 
be separated from the family of the active shooter. Although the FAC should be away from the 
incident command, care should be taken to ensure that it is not so far away from the incident site 
that family members feel excluded. 


Having family members wait for long periods of time for information about their loved ones not 
only adds to their stress and frustration, but can also escalate the emotions of the entire group. 
Section 8.2: Psychological First Aid describes in more detail how to prepare for and handle 
victims’ emotional and psychological needs. When families are reunited, it is critical that there 
are child release processes in place where minors might be involved (e.g., childcare or 
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discharged patients) to ensure that no child is released to an unauthorized person, even if that 
person is well-meaning.” 


Essential steps to help establish trust and provide family members with a sense of control can be 
accomplished by identifying a safe location separate from distractions and/or media and the 
general public, but close enough to allow family members to feel connected in proximity to their 
children/loved ones; scheduling periodic updates even if no additional information is available; 
being prepared to speak with family members about what to expect when reunited with their 
loved ones; and ensuring effective communication with those who have language barriers or 
need other accommodations, such as sign language interpreters for deaf or hard of hearing family 
members. 


When reunification is not possible because an individual is missing, injured, or killed, how and 
when this information is provided to families is critical. Before an emergency, the planning team 
must determine how, when, and by whom loved ones will be informed if their loved one is 
missing or has been injured or killed, keeping in mind that law enforcement typically takes the 
lead on death notifications related to criminal activity. This will ensure that families and loved 
ones receive accurate and timely information in a compassionate way. 


While law enforcement and medical examiner procedures must be followed, families should 
receive accurate information as soon as possible. In cases where an individual has been killed, 
describe the importance of processing the scene for forensic, investigative purposes and to ensure 
accurate identification of victims. It is best to avoid making promises that cannot be kept with 
regard to timing of identification and release of victims’ remains. Training personnel 
immediately available to talk to loved ones about death and injury can ensure the notification is 
provided to family members with clarity and compassion. Crisis responders should be on hand to 
immediately assist family members. 


The OEP should include pre-identified points of contact to work with and support family 
members (e.g., Federal victim assistance personnel counselors, police officers). These points of 
contact should be connected to families as early in the process as possible, including while an 
individual is still missing but before any victims have been positively identified. After an 
incident, it is critical to confirm that each family is getting the support it needs, including over 
the long term. 


The OEP should consider printed and age-appropriate resources to help families recognize and 
seek help with regard to a variety of reactions that they or their loved ones can experience during 
and after an emergency. It is critical that families and loved ones are supported as they both 
grieve their loss and support their surviving family members. 


The OEP also should explicitly address how impacted families will be supported if they prefer 
not to engage with the media. This includes strategies for keeping the media separate from 


?7 A useful resource regarding this topic is the Post-Disaster Reunification of Children: A Nationwide Approach, 
published by FEMA, the American Red Cross, the Department of Health and Human Services, and the National 
Center for Missing and Exploited Children. It can be accessed at: http://www.fema.gov/media-library- 
data/1384376663394-eef4a1b4269de14faff40390e4e2f2d3/Post+ Disaster+Reunification+of+Children+- 
+A+Nationwide+Approach.pdf. 
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families and staff while the emergency is ongoing and support for families that may experience 
unwanted media attention at their homes. 


8.2 Psychological First Aid 


An important aspect of recovery is to treat the emotional side effects of violence and stress. 
Psychological first aid (PFA) is an evidence-informed, modular approach used by mental health 
and disaster response workers to help individuals of all ages in the immediate aftermath of 
disaster and terrorism. PFA is designed to reduce the initial distress caused by traumatic events 
and to foster short- and long-term adaptive functioning and coping. 


PFA does not assume that all survivors will develop mental health problems or long-term 
difficulties in recovery. Instead, it is based on an understanding that disaster survivors and others 
affected by such events will experience a broad range of early reactions (e.g., physical, 
psychological, behavioral, spiritual). Some of these reactions may cause enough distress to 
interfere with adaptive coping, and recovery may be helped by support from compassionate and 
caring disaster responders. 


PFA is designed for delivery by mental health and other disaster response workers who provide 
early assistance to affected children, families, and adults as part of an organized disaster response 
effort. These providers may be embedded in a variety of response units, including first responder 
teams, the incident command structure, primary and emergency health care, incident crisis 
response teams, faith-based organizations, community emergency response teams, Medical 
Reserve Corps, the Citizen Corps, the Department of Defense Disaster Mental Health Response 
teams, and other disaster relief organizations. 


Basic objectives of PFA: 
e Establish a human connection in a non-intrusive, compassionate manner. 
e Enhance immediate and ongoing safety and provide physical and emotional comfort. 
e Calm and orient emotionally overwhelmed or distraught survivors. 


e Help survivors specifically discuss what their immediate needs and concerns are and 
gather additional information as appropriate; offer practical assistance and information to 
help survivors address their immediate needs and concerns. 


e Connect survivors as soon as possible to social support networks, including family 
members, friends, and neighbors. 


e Support adaptive coping, acknowledge coping efforts and strengths, and empower 
survivors; encourage adults, children, and families to take an active role in their recovery. 


e Provide information that may help survivors cope effectively with the psychological 
impact of disasters. 


e When appropriate, link the survivor to another member of a disaster response team or to 
local recovery systems, mental health services, public sector services, and organizations. 


o PFA is designed for delivery in diverse settings. Mental health and other disaster 
response workers may be called upon to provide PFA in the following: 
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= General population shelters; 

= Shelters for those with disabilities and others with access/functional needs; 
= Field hospitals and medical triage areas; 

= Acute care facilities (e.g., emergency departments); 

= Staging areas or respite centers for first responders or relief workers; 
= Emergency operations centers; 

= Crisis hotlines or phone banks; 

= Mobile dining facilities; 

= Disaster assistance service centers; 

= Family reception and assistance centers; 

= Homes; 

= Businesses; and 


= Other community settings.”® 


8.3 Training on Psychological First Aid 


PFA training can be provided in person or online. The online version” is broadly used and is a 
six-hour interactive course that puts the participant in the role of a provider in a post-disaster 
scene. This professionally narrated course is for individuals new to disaster responses who want 
to learn the core goals of PFA, as well as for seasoned practitioners who want a review. It 
features innovative activities, video demonstrations, and mentor tips from the Nation’s trauma 
experts and survivors. PFA online also offers a learning community where participants can share 
experiences using PFA in the field, receive guidance during times of disaster, and obtain 
additional resources and training. 


The Psychological First Aid: Field Operations Guide” provides information for adults, families, 
first responders, disaster relief workers, crisis counselors, and volunteers to help survivors 
immediately in the aftermath of a traumatic event. The guide describes key steps for providing 
PFA, including how to approach someone in need, how to talk to them, how to help stabilize 
someone, and how to gather information. Appendices include resources about service delivery 
sites and settings, provider care, and worksheets and handouts. 


*® The content for this section was taken from Psychological First Aid Field Operations Guide, which is available at 
http://www.nctsn.org/sites/default/files/pfa/english/1-psyfirstaid_final_complete_manual.pdf. 


29 For more information, visit http://learn.nctsn.org/, 


°° For more information, visit http://www.nctsn.org/content/psychological-first-aid. 
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Following disasters or emergencies, the PFA Mobile application can assist responders who 
provide PFA to adults, families, and children. Materials in PFA Mobile are adapted from the 
Psychological First Aid: Field Operations Guide (2nd Edition).”" 


The application allows responders to: 
e read summaries of the eight core PFA actions; 
e match PFA interventions to specific stress reactions of survivors; 
e get mentor tips for applying PFA in the field; 
e _self-assess to determine their own readiness to conduct PFA; and 


e assess and track survivors’ needs to simplify data collection and referrals. 


8.4 Managing the Responses to Victims and Families 


Victim and family support is a critical component to ensuring a successful overall response to a 
critical incident. It is important to ensure the response is coordinated through each phase 
including the immediate response, transition process, and post-crisis support in a way that 
integrates into the investigative and operational response. There are predictable challenges and 
practical solutions in mass casualty events. Coordination with local resources is critical to ensure 
a smooth provision of services throughout the longevity of the case. The quality of the overall 
operational response to a mass casualty will, in large part, be judged by the response to victims 
and families, and should be based upon trust, cooperation, and respect shown to victims, families, 
and eye witnesses. Response planning should always track and adjust to meet the needs of the 
victim/family and the dynamics of the situation. Some considerations include (but are not limited 
to): 


e information sharing; 

e victim identification; 

e family response management teams; 
e communications plans; and 

e resource coordination. 


For more information, please see Appendix A: Victim and Family Support Considerations. 


9 Resources/Templates 
The list below contains links to useful active shooter websites, with a brief description for each: 


1. FBI Active Shooter Statistics 2000-2013: 
http://www.fbi.gov/news/stories/2014/september/fbi-releases-study-on-active-shooter- 


3! For more information, visit http://www.nctsn.org/content/pfa-mobile. 
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incidents/fbi-releases-study-on-active-shooter-incidents?utm_campaign=email- 
Immediate&utm_medium=email&utm_source=fbi-top-stories&utm_content=359177 
2. FBI Active Shooter public site: 


3. FEMA Active Shooter Training (IS-907: Active Shooter: What You Can Do): 
http://training. fema.gov/EMIWeb/IS/courseOverview.aspx?code=IS-907 

4. FEMA Guide for Developing High Quality Emergency Operations Plans for Houses of 
Worship: http://www.fema.gov/media-library/assets/documents/33007?id=7649 

5. FEMA Guide for Developing High Quality School Emergency Operations Plan: 
http://www.fema.gov/media-library/assets/documents/33599?id=7849 

6. FEMA Guide for Developing High Quality Emergency Operations Plans for Institutions 


of Higher Education: http://www.fema.gov/media- 
library/assets/documents/33597 ?id=7848 


9.1 ISC Documents Referencing Active Shooter 
1. ISC Violence in the Federal Workplace: A Guide for Prevention and Response and 
Appendix, 1“ Edition (April 2013): http://www.dhs. gov/publication/interagency-security- 
committee-violence-federal-workplace-guide-april-2013 
2. ISC Occupant Emergency Programs Guide, 1“ Edition (March 2013): 
http://www.dhs.gov/publication/isc-occupant-emergency-programs-guide 


9.2 Other Government Resources 


1. Air Force Be Ready Active Shooter: 
http://www.beready.af.mil/disasters&emergencies/activeshooter.asp 

2. DHS Active Shooter Video: http://www.dhs.gov/video/options-consideration-active- 
shooter-training-video 

3. DHS Active Shooter Preparedness website: http://www.dhs.gov/active-shooter- 
preparedness 

4. DHS Office for Bombing Prevention counter-IED training courses and information: 
http://www.dhs.gov/bombing-prevention-training-courses 

5. DOJ/FBI/NTSB — Mass Fatality Incident Family Assistance Operations: Recommended 
Strategies for Local and State Agencies: 
http://www.ntsb.gov/tda/doclib/Mass%20Fatality%20Incident%20Family%20Assistance 
%20Operations.pdf 


6. DOJ Traumatic Incident Management: http://www. justice.gov/jmd/hr/hrorder/chpt7- 
2.htm 
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7. DOJ Report on the National Summit on Multiple Casualty Shootings: 
https://www.fletc.gov/sites/default/files/imported_files/publications/summits-on- 
preventing-multiple-causality-violence/e021311546_ MultiCasualty- 

Violence _v508_05APR13.pdf 


8. FBI Law Enforcement Bulletin “Active Shooter Events from 2000 to 2012” written by J. 
Pete Blair, M. Hunter Martaindale, and Terry Nichols. The article can be found on 
FBI.gov at http://leb.fbi.gov/2014/january/active-shooter-events-from-2000-to-2012. 


9. FBI Active Shooter Events from 2000-2012: http://leb.fbi.gov/2014/january/active- 
shooter-events-from-2000-to-2012 


10. FEMA — Mass Casualty Training (IS-360: Preparing for Mass Casualty Incidents: A 
Guide for Schools, Higher Education, and Houses of Worship): 


http://training.fema.gov/is/courseoverview.aspx ?code=IS-360 

11. FEMA — Multi-Hazard Emergency Planning for Schools (IS-362A): 
www.training.fema.gov/is/courseoverview.aspx?code=IS-362.a 

12. FLETC — Active Shooter How to Respond, Supervisor Edition: 


http://www.co.lincoln.or.us/sites/default/files/fileattachments/sheriff039s_office/page/37 
80/activeshooterhowtorespondonesupervisor.pdf 


13. Navy Active Shooter: 
http://www.ready.navy.mil/be_informed/terrorism/active_shooter.html 


14. Texas State University compiled statistics (published by the FBI) on active shooter events 
from 2000-2012: http://leb.fbi.gov/2014/january/active-shooter-events-from-2000-to- 
2012 


9.3 HIPAA and FERPA Resource Cards for Printing 


HIPAA and FERPA reference cards with Privacy Rule information can be found at: 
http://www.fbi.gov/about-us/cirg/active-shooter-and-mass-casualty-incidents or readers of this 
document may use the images pasted below to print them directly without the link (see next 


page). 
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Health Insurance Portability and 
Accountability Act (HIPAA) Privacy Rule: 
A Guide for Law Enforcement 


What is the HIPAA Privacy Rule? 


The Health Insurance Portability and Accountability Act of 
1996 (HIPAA) Privacy Rule provides Federal privacy 
protections for individually identifiable health information, 
called protected health information or PHI, held by most 
health care providers and health plans and their business 
associates. The HIPAA Privacy Rule sets out how and with 
whom PHI may be shared. The Privacy Rule also gives 
individuals certain rights regarding their health information, 
such as the rights to access or request corrections to their 
information. 


Who must comply with the HIPAA Privacy Rule? 


HIPAA applies to health plans, health care clearinghouses, 
and those health care providers that conduct certain health 
care transactions electronically (e.g., billing a health plan). 
These are known as covered entities. Hospitals, and most 
clinics, physicians and other health care practitioners are 
HIPAA covered entities. In addition, HIPAA protects PHI 
held by business associates, such as billing services and 


Under what circumstances may a HIPAA covered 
entity disclose PHI to law enforcement? 


AHIPAA covered entity may disclose PHI to law 
enforcement with the individual's signed HIPAA 
harkati 


A HIPAA covered entity also may disclose PHI to law 
enforcement without the individual’s signed HIPAA 
bni in incid. includi 


è To report PHI to a law enforcement official reasonably 
able to prevent or lessen a serious and imminent threat 
to the health or safety of an individual or the public. 


© To report PHI that the covered entity in good faith 
believes to be evidence of a crime that occurred on the 
premises of the covered entity. 


© To alert law enforcement to the death of the individual, 
when there is a suspicion that death resulted from 
criminal conduct. 


© When responding to an off-site medical emergency, as 
necessary to alert law enforcement to criminal activity. 


© To report PHI to law enforcement when required by law 
to do so (such as reporting gunshots or stab wounds). 


others, hired by covered entities to perform services or 
functions that involve access to PHI. 


Who is not required to comply with the HIPAA Privacy 
Rule? 


Many entities that may have health information are not 
subject to the HIPAA Privacy Rule, including: 


employers, 


most state and local police or other law 
enforcement agencies, 


many state agencies like child protective services, 
and 


most schools and schoo! districts. 


While schools and schoo! districts maintain student health 
records, these records are in most cases protected by the 
Family Educational Rights and Privacy Act (FERPA) and not 
HIPAA. HIPAA may apply however to patient records ata 
university hospital or to the health records of non-students 


xs AN 
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at a university health clinic. 


© To comply with a court order or court-ordered warrant, a 
subpoena or summons issued by a judicial officer, or an 
administrative request from a law enforcement official 
{the administrative request must include a written 
statement that the information requested is relevant and 
material, specific and limited in scope, and de-identified 
information cannot be used). 


To respond to a request for PHI for purposes of 
identifying or locating a suspect, fugitive, material 
witness or missing person, but the information must be 
limited to basic demographic and health information 
about the person. 


To respond to a request for PHI about an adult victim of a 
crime when the victim agrees (or in limited circumstances 
if the individual is unable to agree). Child abuse or 
neglect may be reported, without a parent's agreement, 
to any law enforcement official authorized by law to 
receive such reports. 


For More Information 

This is a summary of the relevant provisions and does not 
include all requirements that are found in the HIPAA 
Privacy Rule. For complete information, please visit the 
U.S. Department of Health and Human Service's Office for 
Civil Rights HIPAA web site at 
http://www_hhs.gov/ocr/privacy. 
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Family Educational Rights and Privacy Act 
A Guide for First Responders and Law 


Enforcement 
= 


What is FERPA? 

The Family Educational Rights and Privacy Act (FERPA) is a 
Federal law that protects the privacy of student education 
records. The law applies to all educational institutions and 
agencies (termed “schools” below) that receive funds 
under any U.S. Department of Education program. FERPA 
gives parents certain rights with respect to their children's 
education records. These rights transfer to the student 
when he or she reaches the age of 18 or attends a 
postsecondary institution. Students to whom the rights 
have transferred are “eligible students.” 


FERPA protects the rights of parents or eligible 
students to: 
inspect and review education records; 
seek to amend education records; 
consent to the disclosure of information from 
education records, except as specified by law. 


FERPA permits the non-consensual 
disclosure of PII from “education records” 
for health and safety emergencies and 
judicial orders. 


Discussed below are some relevant exceptions to FERPA’s 
general consent rule that permit the non-consensual 
disclosure of PII from education records to law 
enforcement agencies: 


Schools may non-consensually disclose designated 
“directory information” to law enforcement agencies. 


This is permitted if the school has provided notice to 
parents and eligible students of PII from student education 
records that the school has designated as directory 
information and if the parents and eligible students have 
not opted out of directory information disclosures. 
Directory information is information from an education 
record that would not generally be considered harmful or 
an invasion of privacy if disclosed and may include items 
such as name, address, telephone listing, and participation 
in sports. 


What information can schools provide to law 
enforcement? 


Generally, schools may disclose personally identifiable 
information (Pll) from students’ education records to 
outside parties, including local law enforcement, only if the 
parent or the eligible student has provided prior written 
consent. “Education records” are defined as those records 
that are directly related to a student and maintained by a 
school or a party acting for the school, and include student 
records such as transcripts, disciplinary records, 
immunization records, and other similar records. 


However, there are exceptions to the definition of 
“education records.” One of these exceptions is for school 
“law enforcement unit (LEU) records.” These records are 
defined as records that are (1) created by a LEU; (2} created 
for a law enforcement purpose; and (3) maintained by the 
LEU. These records are not protected under FERPA and can 
be disclosed according to school! policy or as required by 
law. Education records that are in the possession of the LEU 
do not lose their status as education records and must 
continue to be protected under FERPA. 


Schools may non-consensually disclose PII from education 
records in connection with a health or safety emergency. 
When an articulable and significant threat exists — anything 
from an active shooter to a hazardous weather event to a 
chemical spill — school officials are permitted to disclose PII 
from education records to appropriate parties, such as law 
enforcement, in order to protect the health and safety of 
students or other individuals. Schools are allowed to share 
this information only during the period of the emergency, 
and they have to meet certain recordkeeping requirements. 


Schools may non-consensually disclose PII from education 
records in order to comply with a judicial order or a 
lawfully issued subpoena. Prior notification to parents and 
students is generally required, though there are some 
exceptions for law enforcement subpoenas where the court 
or issuing agency has ordered that the existence or 
contents of the subpoena or the information furnished in 
response to the subpoena not be disclosed. 


Questions about FERPA? 

Email the U.S. Department of Education’s Family Policy 
Compliance Office with questions about FERPA at 
FERPA.Customer@ed.gov. You may also contact your legal 


counsel for advice. 
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9.4 DHS Active Shooter Pocket Cards for Printing 


DHS Active Shooter Pocket Cards information can be found at: 
http://www.dhs.gov/publication/active-shooter-pocket-card or readers of this document may use 
the images pasted below to print them directly without the link (see below). 


PROFILE 
* Be aware of your environment and any An active shooter is an 
possible dangers individual actively engaged in killing or 


attempting to kill people in a confined and 
populated area, typically through the use 
of firearms. 


* Take note of the two nearest exits in any 
facility you visit 


Ifyou are in an office, stay there and 
secure the door 


* Attempt to take the active shooter down 
as a last resort 


CHARACTERISTICS 


* Victims are selected at random 


* The event is unpredictable and evolves 
quickly 
* Law enforcement is usually required to 
Contact your building management or end an active shooter situation 
human resources department for more 


information and training on active 
shooter response in your workplace. 


CALL 911 WHEN IT 


IS SAFE TO DO SO 


HOW TO RESPOND 


* Remain calm and follow instructions 


1. RUN * Put down any items in your hands (i.e., 
* Have an escape route and plan in mind bags, jackets) 
+ Leave your belongings behind * Raise hands and spread fingers 
* Keep your hands visible * Keep hands visible at all times 

e Avoid quick movements toward officers 

2. HIDE such as holding on to them for safety 
* Hide in an area out of the shooter’s view + Avoid pointing, screaming or yelling 
* Block entry to your hiding place and lock * Do not stop to ask officers for help or 
the doors direction when evacuating 


* Silence your cell phone and/or pager 


3. FIGHT 


° Asa last resort and only when your life is 
in imminent danger 


* Attempt to incapacitate the shooter 


* Location of the active shooter 


* Act with physical aggression and throw * Number of shooters 


items at the active shooter * Physical description of shooters 
; * Number and type of weapons held by 
CALL 911 WHEN shooters 
IS SAFE TO DO * Number of potential victims at the location 
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9.5 Non-Federal Government Resources 


The Federal Government does not officially endorse the organizations below or their products. 
These materials have been provided here for educational purposes only. 


SO} Oh e w 


10. 


Texas State University Advanced Law Enforcement Rapid Response Training: 
http://www.alerrt.org 


National Law Enforcement and Corrections Technology Center (NLECTC): 
https://www.justnet.org/About_NLECTC.html 


Tactical Emergency Casualty Care website: http://www.c-tecc.org/ 
Counseling Team International: http://www.thecounselingteam.com/ 
International Critical Incident Stress Foundation (ICISF): http://www..icisf.org/ 


Active Response Training: http://www.activeresponsetraining.net/ 


Behavioral Threat Assessment: 
http://www.threatassessment.vt.edu/Implementing Behavioral_Threat_Assessment.pdf 


Police Executive Research Forum (PERF) Mar 2014 Report “The Police Response to 
Active Shooter Incidents”: 


http://www.policeforum.org/assets/docs/Critical_Issues_Series/the%20police%20respons 
e%20to%20active%20shooter%20incidents%202014.pdf 


Stratfor Video Reacting to Active Shooter Situation: 
http://www.stratfor.com/video/conversation-reacting-armed-assailants 


New York City Police Department's "Active Shooter: Recommendations and Analysis for 
Risk Mitigation" 2012: 


http://www.nypdshield.org/public/SiteFiles/documents/Activeshooter.pdf 


9.6 Foreign Resources 


1; 


Australia-New Zealand Counter-Terrorism Committee — Active Shooter Guidelines for 


Places of Mass Gathering: http://www.nationalsecurity.gov.au/Media-and- 
publications/Publications/Documents/active-shooter-guidelines-places-mass- 


gathering. pdf 
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List of Abbreviations/Acronyms/Initializations 


TERM DEFINITION 


ADA Americans with Disabilities Act 

ALERRT Advanced Law Enforcement Rapid Response Training 
ASO Armed Security Officer 

ASTITP Active Shooter Threat Instructor Training Program 
ASTTP Active Shooter Threat Training Program 

BAU Behavioral Analysis Unit 

CCP Casualty Collection Point 

CFR Code of Federal Regulations 

COOP Continuity of Operations 

DEA Drug Enforcement Agency 

DHS Department of Homeland Security 

DOJ Department of Justice 

EAP Employee Assistance Program 

EEO Equal Employment Opportunity 

EMS Emergency Medical Services 

EO Executive Order 

FAC Family Assistance Center 

FBI Federal Bureau of Investigation 

FEMA Federal Emergency Management Agency 

FERPA Family Educational Rights and Privacy Act 
FLETC Federal Law Enforcement Training Center 

FOUO For Official Use Only 

FPS Federal Protective Service 

FSP Facility Security Plan 

HIPAA Health Insurance Portability and Accountability Act 
IARD Immediate Action Rapid Deployment 

ICS Incident Command System 

IED Improvised Explosive Device 

IFAK Individual First Aid Kit 

IRS Internal Revenue Service 

IS Independent Study 

ISC Interagency Security Committee 

JIC Joint Information Center 

LEFRTP Law Enforcement First Responder Training Program 
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LEO Law Enforcement Officer 

MRI Magnetic Resonance Imaging 

NCAVC National Center for the Analysis of Violent Crime 
NGO Non-governmental Organization 

NIMS National Incident Management System 

NIST National Institute of Standards and Technology 
OEO Occupant Emergency Organization 

OEP Occupant Emergency Program or Plan 

OSH Occupational Health and Safety 

PAO Public Affairs Officer 

PFA Psychological First Aid 

PPD Presidential Policy Directive 

SALT Sort-Assess-Lifesaving Interventions-Treatment/Transport 
SIP Shelter-In-Place 

SOP Standard Operating Procedure 

SSM Site Security Manager 

START Simple Triage and Rapid Treatment 

TAT Threat Assessment Team 

USCG United States Coast Guard 

USMS United States Marshals Service 

USSS United States Secret Service 


Planning and Response to an Active Shooter 


40 


Glossary of Terms 


TERM DEFINITION 


Active An individual or individuals actively engaged in killing or attempting to kill 
Shooter/Active | people in a confined and/or populated area. In most cases, firearms are the 
Threat weapon of choice during mass casualty incidents but any weapon (such as a 


knife, etc.) can be utilized to harm innocent individuals and typically there is no 
pattern or method to the selection of victims. 


Contact Team |A group of law enforcement officers who assemble and proceed directly to the 
sounds of violence with the goal of making contact with the perpetrator(s). 


Designated Those individuals responsible for a facility’s OEO and OEP. This includes 


Officials staffing, training, developing, maintaining, and implementation of the OEO and 
OEP. 

Employee Federally required program which provides short-term counseling and referral 

Assistance services to employees at no cost. 

Program 

Family An area where families may gather to ascertain information about loved ones 

Assistance after a mass casualty emergency. 

Center 

Federal Government leased and owned facilities in the United States (inclusive of its 

Facilities territories) occupied by Federal employees for nonmilitary activities. 

Mitigation The capabilities necessary to eliminate or reduce the loss of life and property 


damage by lessening the impact of an event or emergency. Mitigation also 
means reducing the likelihood that threats and hazards will happen. 


Occupant Preparedness documents which cover a spectrum of emergency situations 
Emergency ranging from essential services interruptions, communicated threats, incidents 
Plan posing a risk of injury or significant property damage, hazardous conditions, 


and incidents posing an immediate threat to life or property, including active 
shooter attacks. 


Preparedness |PPD-8 characterizes preparedness using five mission areas: Prevention, 
Protection, Mitigation, Response, and Recovery. 


Prevention The capabilities necessary to avoid, deter, or stop an imminent threat. 
Prevention is the action agencies take to keep a threatened or actual incident 
from occurring. 


Protection The capabilities to secure facilities against acts of terrorism and man-made or 
natural disasters. Protection focuses on ongoing actions that protect employees, 
visitors, networks, and property from a threat or hazard. 


Psychological | An evidence-informed, modular approach used by mental health and disaster 
First Aid response workers to help individuals of all ages in the immediate aftermath of 
disaster and terrorism. 


Public Affairs | Responsible for developing and releasing information about an incident to the 
Officer news media, incident personnel, and other agencies and organizations, as 
appropriate. 
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Recovery The capabilities necessary to assist facilities affected by an event or emergency 
in restoring the work environment as soon as possible. 

Response The capabilities necessary to stabilize an emergency once it has already 
happened, restore and establish a safe and secure environment, save lives and 
prevent the destruction of property, and facilitate the transition to recovery. 

Threat Responsible for addressing threats, confronting violent behavior, and assisting 

Assessment in assessing potential for violence. 

Team 
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Interagency Security Committee Participants 


Interagency Security Committee 


Bernard Holt 
Acting Executive Director 


Interagency Security Committee Representative 
Lindsey E. Blair 
Acting Deputy Executive Director 
Working Group Chair 


Glen Legus 
United States Marshals Service 


Working Group Participants 


Jeffrey Afman 


Federal Emergency Management Agency 


Douglas Baker 
General Services Administration 


Jerry Castleberry 
Round Rock Police Department 


Craig Cruz 
Environmental Protection Agency 


Megan Drohan 
Interagency Security Committee 


Timothy Gregg 
Internal Revenue Service 


Dennis Jahnke 
Hennepin County Sheriff’s Office 


David Knoff 
California Highway Patrol 


James P. Leonard 
Customs and Border Protection 


William (Chip) Ayers 
Customs and Border Protection 


Katheryn (Denise) Ballew 
Federal Bureau of Investigation 


Brice Cook 
Department of Energy 


Keith Dressel 
Customs and Border Protection 


Jim Gallagher 
Department of Interior 


Michael Griffin 
General Services Administration 


Heather King 
National Security Council 


David Leighton 
United States Coast Guard 


Scott Ley 
United States Marshals Service 
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Charles Lombard 


National Aeronautics and Space Administration 


Kenneth Marsalis 
Federal Aviation Administration 


William Morrison 
Federal Aviation Administration 


Peter Orchard 
Federal Bureau of Investigation 


Jennifer Parkinson 
Federal Bureau of Investigation 


James Pelkofski 
Pentagon Force Protection Agency 


Bayne Rector 
Smithsonian Institute 


Katherine Schweit 
Federal Bureau of Investigation 


Jerry Stanphill 
Federal Aviation Administration 


Keith Szakal 
Department of Transportation 


Darryl Ward 
Department of Interior 


Rob Marohn 
Federal Protective Service 


Sandra Mayhall 
Federal Bureau of Investigation 


Mark Murray 
Bureau of Alcohol, Tobacco, Firearms and Explosives 


Jim Palmer 
Federal Law Enforcement Training Center 


Roger Parrino 
Department of Homeland Security 


Charles Pipkins 
Department of Energy 


Terry Register 
Pentagon Force Protection Agency 


Bruce Skean 
Federal Protective Service 


John (JT) Stroud 
United States Department of Agriculture 


David Vaughan 
Federal Bureau of Investigation 


Jesse Williamson 
Interagency Security Committee 


Planning and Response to an Active Shooter 


45 


Appendix A: Victim and Family Support 
Considerations 


There are several elements of a successful response. They include the right plan, the right people, 
and the right focus. The first element is ensuring the right people are involved. These responders 
will manage and coordinate as well as deliver services. Responders should have an 
understanding of the issues and needs, and the ability to access and apply resources. Appropriate 
support to victims and families should be provided by experienced front-line providers. Not all 
law enforcement agencies have internal victim assistance personnel and resources and knowing 
what community resources and partners are available to assist will help in the absence of a victim 
assistance program. Having the right plan is also part of a successful response. The victim 
assistance response should be integrated into incident planning/response, and informed by 
experience and best practices. It is crucial that the relevant players are integrated into this plan. 
Develop a plan that can be adapted and scalable based on the incident response. Exercises can 
serve as a way to modify and improve the response plan. The last element of a successful 
response is having the right focus. Prioritizing addressing victim needs in a timely, 
compassionate, and professional manner is key. Remembering why responders do this work is 
imperative. The focus starts from the top down. It is important to identify a point of contact or a 
manager to oversee the lead agency’s response and to plan and to coordinate with other partners. 
A successful response plan has investigative and operational benefits. Victims and families tend 
to be more cooperative when an agency proactively provides them with support and resources. It 
also assists with identifying, locating, communicating with additional victim/witnesses. The plan 
also ensures a continuous flow of information to and from the victims. 


While each incident will have unique factors, there are predictable response elements in all 
incidents. Victims need accurate and timely information and the availability of a support system. 
Preparation and planning can make the difference in meeting these challenges. The role of law 
enforcement will intersect with victims/families around certain issues including information 
collection and provision including briefings, interviews, and investigative updates. Victim 
identification is another intersection between victims/families and law enforcement. This 
includes ante mortem data collection and missing person reporting in addition to the 
development of a victim list. In addition, death notification is a major interaction between the 
family members and law enforcement, as well as the management of personal effects, both 
evidentiary and non-evidentiary. 


Identifying victims is one of the predictable challenges. The legal definition of a victim tends to 
be more inclusive than exclusive. An incident can result in injured, missing/deceased, walking 
wounded, and eyewitnesses who may be identified as victims. Closed populations include a set 
group of impacted individuals such as an airline manifest. Victim identification and notification 
is less problematic when there is a closed population of victims. In a closed population, victims 
are known and can be accounted for. In an open population, there are unknown number of 
victims, missing persons lists, and identification of whole or fragmented human remains. If a 
death notification is to be delivered to the next of kin, using an effective model can assist with 
reducing the stress of the individual notifying the family as well as the next of kin. The victim 
identification process is likely to be drawn out with open populations and when victim remains 
are disfigured, severely damaged, or fragmented. Victim populations tend to be diverse, which 
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necessitates planning for multi-cultural issues, language barriers, foreign citizens, injured victims 
and other special populations with unique needs. 


There are practical solutions for identifying victims. Law enforcement generally has the legal 
responsibility to identify victims. This process starts at the scene. It is imperative to manage 
expectations. Carefully describing the importance of processing the scene for forensic, and 
investigative purposes, and to ensure accurate identification of victims is critical. There may be a 
need to inform families if the loved ones’ remains are significantly disfigured. Eventually, the 
number of victim remains will begin to align with the number of families who have not located 
their loved ones. This has to be addressed, sooner rather than later. “Provisional” notification can 
be made by telling these families what is known at that point in time about the number of 
deceased victims, what needs to be done to identify victims, and how long the process is 
estimated to take. It is best to avoid making promises that cannot be kept with regard to timing of 
identification and release of victims’ remains. Working collaboratively with the medical 
examiner to determine the most accurate and efficient victim identification process can be of 
great value. Ante-mortem interviews with families to collect identifying information should be 
conducted with a professionally trained victim support person present. When possible, avoid 
showing photographs to families for identification purposes. Ensure the relevant jurisdictions are 
clear on who will be doing the death notifications (Medical Examiner vs. Law Enforcement). 
Death notification should be done in teams (Law Enforcement and victim services provider) 
using a model. How these issues and death notification are handled has a major impact on 
families, as well as their relationship to officials and their perception of responding agencies. 


Management of victim/family response is another predictable challenge. The National 
Transportation Safety Board estimates that an average of eight to twelve family members for 
each missing victim will respond to the incident location or city. Family structures may be very 
complex and may include parents, step-parents, and estranged family members. There will be 
family members who are unable to travel to the site but who still deserve information and 
support. Different victim populations (missing/deceased/hospitalized) may require different 
resources and services. Victims and families will begin asking about personal belongings. For 
the families of the deceased these items assume special significance as they are among the last 
things their loved ones touched and help maintain a physical connection when it is needed most. 


There are quite a few practical solutions to manage the victim/family response. A strong, 
cohesive management team can ensure that the victim response goes smoothly, coordinates and 
maximize resources, and keeps senior officials informed. The team should consist of a 
representative from each responsible agency that is identified prior to an active shooter incident. 
Victim/Family Assistance Centers have been established in response to many events. FAC 
models generally are intended to support families of the missing/deceased in the immediate 
aftermath until all the victims have been recovered and identified. FACs may need to remain 
open through the period of funerals/burials. Considerations should be made for victims who are 
unable to travel, such as using phone conference bridges and websites. FBI Victim Specialists 
are located around the country and may be called upon to personally assist with notifications and 
other support to out of town family members. The plan should include all types of victims and 
multiple delivery points. Some victim needs are the same — information, emergency assistance, 
support — but some needs will be distinctly different (families of deceased vs. families of 
hospitalized injured). The needs of victims and the responsibilities for addressing these needs 
evolve along a continuum to include: 
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e the immediate aftermath; 
e identifying victims and providing initial information and support; 
e transition to services that help stabilize victims and families; and 


e long-term provision of information and support associated with protracted investigations 
and potential prosecutions. 


Other considerations include various victim populations specifically, children, persons with 
disabilities, elderly, non-English speaking victims. If the shooter killed members of his/her own 
family, there needs to be a separate process for working with surviving family members. A 
compassionate and supportive approach may enhance their cooperation. 


Communication is another predictable challenge. Communication is the key to an effective 
response. Communicating with victims, families, responders and service providers is paramount 
for a successful outcome. A massive number of inbound calls from family, friends, and the 
public may incapacitate the emergency operations center. Victims have a primary need for 
information from an official source, as soon as it becomes available, and before the media 
receives it. There are practical solutions to work through communication issues. First, determine, 
in advance, one hotline number that will be issued to receive calls from families, friends and the 
public. Second, identify how the hotline will be staffed. A DOJ-funded, professional crisis call 
center may be a potential asset for local agencies. Ensure that the command post is coordinating 
and communicating with the lead victim assistance agency to provide critical victim information 
to victims and families. Deliver accurate information to families. Avoid speculation. It is 
acceptable to explain why complete or specific information cannot be provided at a given point 
in time, especially if it means taking the time necessary to ensure a thorough and accurate 
identification, autopsy, and criminal investigation. Respect victims’ need to know the truth, even 
painful facts, and ensure that information is provided in a sensitive and supportive manner. Share 
victim information as appropriate while protecting victim privacy. The Family Assistance Center 
is usually the best place to deliver briefings as it provides privacy and support. The FAC ensures 
families remain at a centralized location. When identifying a media staging area, consider a 
location some distance from the FAC to avoid unintended interactions between media and 
families. When transitioning after the incident, ensure a formal structure for ongoing 
communication with victims and families to relay ongoing investigative findings and other 
information, as appropriate. To assist with interagency collaboration, Law Enforcement Online is 
a helpful tool to use when discussing victim issues within your agency or with other law 
enforcement agencies and responders. 


Resource coordination is yet another predictable challenge. Many “helpers” and donations will 
show up at scenes and places where victims/families gather. Most will not be needed or helpful, 
especially when families are in acute crisis and having difficulty absorbing information and 
making decisions. Victim needs are basic. They include information, support, practical 
assistance, and privacy from media and well-meaning but unhelpful people. During the 
immediate aftermath of the incident, victims and families are less interested in the criminal 
charges and prosecutions. Acute distress is a common and normal reaction to sudden, violent 
trauma and loss but it does not necessitate mental health counseling, especially in the immediate 
aftermath. Most people cope over time but some will benefit from counseling at a later point. 
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A successful overall response to a critical incident includes a plan to respond to victims and 
families of the event. A coordinated response is critical in order to respond to the predictable 
challenges and practical solutions. Local resources ensure a seamless transition in the aftermath. 
A community’s response to an active shooter event is largely dependent on the support provided 
to victims and their family members. 
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